wlficompany[.]com

On 24 July 2026 analysts observed that wlficompany.com is currently offline but retains several indicators consistent with a cryptocurrency seed‑phrase phishing operation. The domain was registered on 17 December 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare edge address 104.21.1.73, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a legitimate certificate authority. An HTTP request returns status code 403, suggesting that the site is intentionally denying access, possibly after takedown.

The page title, captured before the shutdown, reads “WLFI Wallet – Secure Your Cryptocurrencies with WLFI.co”, and the kit identified is a Seed Phrase Phishing package, indicating that the site likely solicited private seed phrases under the guise of a WLFI wallet service. The operation claims to impersonate the Arbitrum brand, aligning with the “brand target” field. Reputation scoring is extremely low: Gridinsoft assigns a trust score of 0 / 100, and ten of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain appears on one public blocklist and has been listed by PhishDestroy, confirming external detection.

Nameservers coco.ns.cloudflare.com and matteo.ns.cloudflare.com further corroborate Cloudflare hosting. No additional evidence such as malware samples, screenshot captures, or URL paths has been published, leaving the exact phishing flow uncertain. Defenders should continue to block the domain at perimeter filters, monitor for any re‑hosting of the same IP or certificate, and add the indicator set (domain, IP, nameservers, SSL fingerprint) to threat‑intel feeds. Ongoing observation of Cloudflare‑hosted assets that reference the WLFI branding or seed‑phrase terminology is recommended to intercept potential redeployments.