wlfibitoken[.]com

Analysis indicates that wlfibitoken.com was registered on December 17, 2025 through Gname.com Pte. Ltd. The domain resolves to 104.21.68.140, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution uses the Cloudflare name servers coco.ns.cloudflare.com and matteo.ns.cloudflare.com, and the site serves content over HTTP/3 with a TLS certificate issued by Google Trust Services under the WE1 label. An HTTP request returns status code 403, suggesting that the server is actively denying access to the requesting client. The page title observed, “WLFI Wallet – Secure Your Cryptocurrencies with WLFI.co,” combined with the listed scam type “Wallet/Seed Phishing,” indicates a credential‑harvesting operation targeting users of the Arbitrum ecosystem.

The domain is explicitly marked as impersonating the Arbitrum brand. Threat intelligence from AlienVault OTX shows the domain appearing in three separate pulse entries, and the domain is listed on one public blocklist and is blocked by the PhishDestroy service. VirusTotal analysis reports nine of ninety‑five scanning engines flagging the domain, reinforcing the malicious assessment. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, confirming the lack of legitimacy.

No additional evidence such as page screenshots or detailed content analysis is currently available, so the exact phishing workflow remains unknown. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any future resolution changes. Given the active blocklist presence and the low trust score, the domain should be treated as high‑confidence malicious and removed from any allow lists.