wlfireward[.]com

The domain wlfireward.com was registered on October 10, 2025 through Tucows Domains Inc. and is currently active. Infrastructure analysis shows the domain is hosted behind Cloudflare (AS13335) with HTTP/3 enabled and resolves to the IP address 172.67.179.216. The authoritative nameservers are evelyn.ns.cloudflare.com and piotr.ns.cloudflare.com, and the site presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS handshake. The page title returned by the server is "Earn and Borrow Crypto | World Liberty Financial," which does not reference the target brand but the threat profile lists MetaMask as the impersonated brand. The domain appears on a single security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports detections by 11 of 95 security vendors. AlienVault OTX references the domain in one threat‑intelligence pulse. The combination of a low trust score, multiple vendor detections, and explicit brand‑impersonation labeling classifies the site as high‑risk. Defenders should add wlfireward.com and its associated IP address to blocklists, monitor DNS queries for the listed Cloudflare nameservers, and enforce strict outbound filtering for any traffic attempting to contact the domain. Continuous threat‑intel feeds should be consulted for any new indicators, and incident response teams should be prepared to investigate any user reports of MetaMask‑related credential requests that may be routed to this domain.