wlfie[.]com

This domain, wlfie.com, is flagged for brand_impersonation targeting Arbitrum, a decentralized finance platform. Analysis indicates the domain was designed to mimic legitimate Arbitrum wallet interfaces, potentially deceiving users into disclosing sensitive credentials or transferring assets under false pretenses. The page title, 'Wlfi Wallet,' closely resembles authentic wallet services, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Infrastructure analysis reveals the domain was registered on September 17, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IPv6 address 2a06:98c1:3120::3, hosted on AS13335 Cloudflare, Inc., a network commonly leveraged to obscure malicious infrastructure. Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. Notably, the domain lacks an SSL certificate, a red flag for users accustomed to encrypted connections on legitimate financial platforms. Users who visited wlfie.com should immediately revoke any permissions granted to the site within connected wallet applications. It is recommended to monitor transaction histories for unauthorized activity and rotate credentials for any accounts linked to the domain. Given the elevated risk level, affected individuals should assume compromise of any entered data and conduct a full security audit of associated devices. No legitimate Arbitrum services operate under this domain, and all interactions with it should be treated as fraudulent.