wlficlaim[.]pages[.]dev

This domain wlficlaim.pages.dev was registered on March 31, 2026 through Cloudflare, Inc. and is served from Cloudflare’s infrastructure, using the nameservers andronicus.ns.cloudflare.com and kelly.ns.cloudflare.com. DNS resolution points to the IP address 172.66.45.43, which is owned by Cloudflare and geolocated to Canada. The site presents a TLS certificate issued by Let’s Encrypt and enforces HSTS, while also supporting HTTP/3, indicating a modern web stack. The page title returned from the host reads “World Libirty Financia - Bridge USD1 Across Chains”, suggesting a fake airdrop or bridge offering.

Threat intelligence categorizes the activity as a crypto drainer, specifically a fake‑airdrop scheme designed to lure victims into transferring cryptocurrency. VirusTotal scans recorded twelve of ninety‑four security vendors flagging the domain as malicious. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, both of which have taken it down. Current status is offline, but historical activity indicates that the infrastructure was deliberately used to harvest crypto assets.

Defenders should add wlficlaim.pages.dev to URL filtering policies, block the associated IP 172.66.45.43, and monitor for any residual traffic. Continuous observation of Cloudflare‑hosted assets is advised, as the attacker may repurpose the same hosting arrangement for future campaigns. The combination of a Let’s Encrypt certificate, HSTS, and HTTP/3 should not be taken as a trust indicator; instead, these features are commonly abused to lend legitimacy to malicious operations.