wlfi-defi[.]com

This domain, wlfi-defi.com, is flagged as an active crypto scam impersonating Coinbase. Registered on February 21, 2026, through Dynadot LLC, the domain currently resolves to 104.21.64.1, a Cloudflare IP (AS13335) located in the US. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside a 301 HTTP redirect, which is commonly employed to obscure malicious destinations or funnel victims to secondary pages. The page title, 'World Liberty Financial,' does not match the targeted brand but aligns with the reported scam type: crypto fraud. The domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns it a trust score of 0/100, indicating high risk. VirusTotal detections show 3 of 93 security vendors flagging the domain, though the specific nature of these detections is not detailed. The SSL certificate is issued by WE1, a provider frequently used for both legitimate and malicious domains, offering no definitive risk indicator on its own. Defenders should treat this domain as high-risk due to its association with brand impersonation, crypto scam classification, and active blocklist presence. The 301 redirect suggests potential evasion tactics, warranting further investigation into downstream domains or IPs. Network-level blocking of 104.21.64.1 and monitoring of associated nameservers (ns1.dyna-ns.net, ns2.dyna-ns.net) is recommended. No evidence confirms the exact content or functionality of the site, but the combination of technical indicators and scam classification justifies immediate containment measures.