worldlibertyfinancial-global[.]com

This domain, worldlibertyfinancial-global.com, is identified as a credential theft operation targeting users of contract-for-difference (CFD) trading platforms. The site mimics legitimate trading services for stocks, gold, oil, and indices under the pretext of offering investment opportunities. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting tactics used to compromise financial accounts. Analysis indicates the domain was registered through Global Domain Group LLC and resolves to 198.251.83.106, hosted on AS53667 (FranTech Solutions). The domain was created on February 21, 2026, an anomalous future date likely intended to evade detection or mislead investigators. VirusTotal reports 18/95 security vendors flagging the domain, while Google Safe Browsing classifies it as phishing. The domain appears on three security blocklists, including feeds from PhishDestroy and SEAL, and is associated with a Let's Encrypt SSL certificate (R13). The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. However, residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations should monitor for credential reuse attempts, particularly targeting financial services, and update blocklists to include the domain and associated IP. Users who entered credentials are advised to rotate passwords immediately and enable multi-factor authentication on all financial accounts.