wlficheckeligible[.]xyz

The domain wlficheckeligible.xyz was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The site presented a TLS certificate identified as WE1, indicating the use of a standard SSL implementation without custom branding. The page title observed during the brief capture period was "World Liberty Financial - Inspired by Trump, Powered by USD1," which does not reference Binance directly but the domain is documented to impersonate the Binance brand in a crypto‑scam context.

VirusTotal scans returned 11 detections out of 95 security vendors, confirming that multiple anti‑malware engines consider the host malicious. The domain is also present on two external blocklists, specifically PhishDestroy and ScamSniffer, reinforcing its classification as a fraudulent resource. Evidence from the known intelligence does not include a Safe Browsing verdict or additional threat‑intel feeds such as OTX, and no further details about the underlying web application or payload have been disclosed.

The primary uncertainties relate to the exact content served before the takedown and whether the site employed credential‑harvesting forms or cryptocurrency withdrawal scripts. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the host, and apply URL filtering based on the observed indicators. Incident response teams encountering related traffic should capture any payloads for sandbox analysis, and users should be warned against any unsolicited communications claiming to originate from Binance that reference the wlficheckeligible.xyz address.