allocation-worldlibertyfi[.]online

allocation-worldlibertyfi.online was registered on 21 February 2026 and is currently taken offline. The domain resolves to the IP address 104.21.12.252, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title “World Liberty Financial – Shape the Future with our Governance Process,” suggesting a financial‑themed front‑end that is unrelated to the legitimate Binance brand. Intelligence indicates that the domain is being used for a crypto‑related scam that attempts to impersonate Binance, although the exact phishing flow has not been captured. VirusTotal analysis shows that six of ninety‑three scanning engines flagged the domain as malicious, providing early confirmation of suspicious activity.

Independent blocklist services PhishDestroy and ScamSniffer have added the domain to their watchlists, and two additional security blocklists also list the domain, reinforcing the consensus that it should be treated as hostile. The SSL certificate associated with the host is identified as “WE1,” which does not correspond to a trusted certificate authority and further weakens the site’s credibility. Because the domain is offline, live HTTP response codes, content hashes, and Safe Browsing verdicts cannot be verified at this time. No public OTX indicator has been published for this host, and the registrar information has not been disclosed in the available data set. Consequently, the precise attack vector—whether a credential‑harvesting login page, a malicious download, or a redirect to a secondary payload—is still unknown.

Defenders should immediately block any outbound connections to 104.21.12.252 and add allocation-worldlibertyfi.online to DNS‑based deny lists. Email security gateways should be configured to flag messages that reference Binance and contain links to this domain.