wlfi-tokenclaim[.]com

This domain, wlfi-tokenclaim.com, is flagged as an active cryptocurrency phishing site impersonating OKX, a known digital asset exchange. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to Cloudflare-hosted infrastructure, utilizing nameservers mack.ns.cloudflare.com and raquel.ns.cloudflare.com. Analysis indicates a 403 HTTP status, suggesting access restrictions or protective measures, while the page title 'Just a moment...' aligns with Cloudflare interstitial responses. Security vendors on VirusTotal have flagged this domain, with 13 out of 95 engines detecting malicious activity, reinforcing its classification as high-risk. Infrastructure analysis reveals reliance on Cloudflare, a common tactic to obscure origin servers and evade detection. The domain appears on at least one security blocklist, and Gridinsoft assigns it a trust score of 0/100, further corroborating its fraudulent nature. While the exact content of the site remains unanalyzed, the combination of cryptocurrency-themed naming, brand impersonation, and defensive hosting practices strongly suggests an intent to deceive users into disclosing credentials or transferring assets. Defenders should prioritize this domain for immediate blocking, particularly within environments handling cryptocurrency transactions or OKX-related traffic. The use of Cloudflare complicates origin tracing, but the domain’s registration details, nameserver configuration, and detection by multiple security vendors provide sufficient evidence for takedown requests or internal blacklisting. Given its active status and high-risk classification, monitoring for related domains or IP reuse patterns is recommended to preempt further abuse. No additional brand-specific indicators or phishing kits have been confirmed at this stage, but the domain’s purpose aligns with typical cryptocurrency scam operations.