libertyunlock[.]live

Analysis of www.libertyunlock.live shows a confirmed generic phishing operation targeting users of World Liberty Financial. The site presented a page titled “World Liberty Financial | Claim $WLFI — Vesting Round 2,” indicating an attempt to lure victims with a vesting round claim. Technical observations reveal the domain was hosted on Amazon’s AS16509 network (IP 216.198.79.65) in the United States, and DNS was delegated to Cloudflare (ned.ns.cloudflare.com, tani.ns.cloudflare.com). The site employed a Let’s Encrypt R12 certificate, which offers only baseline encryption and does not imply legitimacy.

HTTP responses returned a 451 status, suggesting the content was blocked for legal reasons, and the domain is currently taken offline. Registration records list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, and the domain has been added to a single security blocklist. Detection services have flagged the domain, with five of ninety‑one VirusTotal scanners marking it as malicious.

PhishDestroy also listed the domain as blocked. While the offline status limits immediate payload collection, the combination of a targeted page title, cloud‑based hosting, and multiple vendor detections confirms a phishing intent. Defenders should continue to block the domain at network perimeter, monitor for re‑registration or related subdomains, and update threat intelligence feeds with the observed indicators (IP address, nameservers, registrar, and page title) to prevent future abuse.