wlfi[.]co

The domain wlfi.co is currently active and confirmed as a brand impersonation phishing site targeting users of the Arbitrum cryptocurrency platform. Analysis indicates the site mimics legitimate Arbitrum wallet services, presenting itself as 'WLFI Wallet - Secure Your Cryptocurrencies with WLFI.co' to deceive victims into disclosing sensitive credentials or transferring assets. The domain remains operational and poses an elevated risk to individuals interacting with decentralized finance (DeFi) ecosystems. Infrastructure analysis reveals the domain was registered on September 17, 2024, through NameCheap, Inc. It resolves to the IP address 188.114.97.3, which is associated with Cloudflare services, a common tactic to obscure hosting origins and evade detection. The site employs HTTP/3 and utilizes an SSL certificate issued by Google Trust Services, adding a superficial layer of legitimacy. As of the latest assessment, wlfi.co appears on one security blocklist and is flagged by 5 of 95 security vendors on VirusTotal, indicating moderate but growing detection. The domain's creation date suggests recent deployment, aligning with observed trends in short-lived phishing campaigns targeting cryptocurrency users. Current status confirms wlfi.co remains active and accessible, with no indications of takedown or mitigation at this time. Users are advised to treat this domain as malicious and avoid interaction. Organizations should update web filtering rules to block access to wlfi.co and its associated IP address (188.114.97.3). Cryptocurrency platforms and wallet providers are recommended to monitor for user reports of brand impersonation involving this domain and issue warnings to their communities. Security teams should prioritize hunting for related indicators, including the unique seed 'abecdf', in logs for signs of compromise or attempted credential theft.