unlock-worldlibertyfinancial[.]org

Analysis of unlock-worldlibertyfinancial.org shows that the domain was registered on February 21, 2026 through OwnRegistrar, Inc. The authoritative nameservers are lily.ns.cloudflare.com and mitch.ns.cloudflare.com, indicating that the site was served behind Cloudflare's network. DNS resolution points to 172.67.192.16, an address owned by AS13335 Cloudflare, Inc., and the SSL certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of Cloudflare’s edge TLS termination. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, which aligns with Cloudflare’s default block page for suspected abuse.

VirusTotal scans recorded 16 detections out of 93 submitted security vendors, confirming that multiple antivirus engines consider the host malicious. Automated fingerprinting identified Cloudflare Browser Insights, Cloudflare, and HTTP/3 as active technologies, further corroborating the hosting environment. Reputation scoring from Gridinsoft is 0 out of 100, and the domain is listed on two external blocklists, specifically PhishDestroy and ScamSniffer, reinforcing the elevated risk assessment.

The current operational status is offline, as indicated by the 403 response and the "taken offline" note in the intelligence feed. Uncertainty remains regarding the exact phishing payload or credential‑stealing mechanisms because no page content was captured beyond the title. Defenders should continue to block the domain at perimeter filters, monitor for any future resolution changes, and incorporate the IP address 172.67.192.16 into threat‑intel feeds, while also ensuring that any user‑initiated requests to the domain are denied.