distributions-wlfi[.]org

distributions-wlfi.org is a newly registered domain (created 23 June 2025) that targets MetaMask users with a crypto‑drain scam. The site’s visible page title, “Earn and Borrow Crypto | World Liberty Financial,” indicates a financial‑offer narrative but does not reference MetaMask directly. The domain was registered through Hostinger operations, UAB, and is hosted on Cloudflare’s network (IPv6 address 2606:4700:3037::ac43:8c29, AS13335, United States). The TLS certificate listed as “WE1” is active, suggesting the site was reachable over HTTPS before being taken offline.

Security scanners have raised concerns: VirusTotal reports three of ninety‑three AV engines flagging the domain, and Gridinsoft assigns a trust score of zero out of one hundred. Independent blocklists, including PhishDestroy and ScamSniffer, have already listed the domain, and it appears on two additional security blocklists. The combination of a low trust score, multiple vendor detections, and blocklist listings points to a high likelihood of malicious intent. Because the site is currently offline, live content cannot be examined, leaving the exact phishing or credential‑harvesting mechanisms unknown.

Defenders should proactively block the IPv6 address and the domain name at perimeter defenses, add the domain to internal blacklist feeds, and monitor for any future re‑registration or use of similar naming patterns. Continued observation of Cloudflare‑hosted assets targeting MetaMask users is advised, as the infrastructure choice may be reused for other campaigns. Incident response teams should also consider reviewing recent logs for any outbound connections to the listed IP and correlate with user reports of unauthorized MetaMask activity.