wlfim[.]com

The domain wlfim.com has been identified as a brand impersonation threat specifically targeting Across Protocol, a cross-chain bridging platform. This domain was actively presenting a fraudulent airdrop page titled 'World Liberty Financial - Airdrop,' designed to deceive users into interacting with malicious smart contracts or disclosing sensitive wallet credentials. As of the latest verification, the domain has been taken offline, though residual risk remains for users who may have engaged prior to its removal.

Technical analysis reveals that wlfim.com was registered on December 17, 2025, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. The domain resolved to the IP address 104.233.255.48, hosted under AS398478 (PEG TECH INC) in Hong Kong, a network segment with a history of supporting phishing and fraudulent activities. Security vendors on VirusTotal flagged the domain as malicious, with 13 out of 95 engines detecting it at the time of assessment. Additionally, the domain appeared on one security blocklist, and its SSL certificate was issued by Let's Encrypt (R13), a common choice for threat actors due to its low barrier to entry and short validity periods. The combination of these indicators—registrar reputation, hosting provider, and detection rates—strongly suggests deliberate malicious intent.

Given the domain's current offline status, immediate interaction risks are mitigated; however, organizations and users should remain vigilant. Entities associated with Across Protocol or similar DeFi platforms are advised to monitor for recurring impersonation attempts, particularly those leveraging airdrop-themed lures. Network defenders should update blocklists to include the domain and its associated IP (104.233.255.48) to prevent future access. Users who may have interacted with the site should revoke any connected smart contract approvals, rotate credentials, and scan for unauthorized transactions. Proactive monitoring of newly registered domains under the same registrar or hosting provider may help preempt similar threats.