worldlibertyfinancialsystem[.]com

The domain worldlibertyfinancialsystem.com was registered on 2026-02-21 through Global Domain Group LLC. VirusTotal reports that 6 of 95 security vendors have flagged the domain, and it appears on a single security blocklist (PhishDestroy). The site returned HTTP 200 and is currently active.

Infrastructure analysis shows the domain resolves to IP address 104.21.48.148, which belongs to AS13335 Cloudflare, Inc., located in the United States. The authoritative name servers are sterling.ns.cloudflare.com and thea.ns.cloudflare.com, indicating the use of Cloudflare's DNS and CDN services. TLS is provided by Google Trust Services under the WE1 certificate, and the connection negotiates HTTP/3.

The page title observed is “World Liberty Financial System - Away From The Traditional Financial System”, and the site leverages Bootstrap, Smartsupp, Cloudflare Browser Insights, and Cloudflare. The campaign is classified as a wallet_connect_phish and impersonates the DHL brand. The risk level is high and the status is active.

While the page content has not been fully examined, the combination of brand impersonation, wallet‑connect phishing, and the presence on a blocklist suggests a credential‑harvesting operation targeting DHL customers. Defenders should block the domain at network perimeters, update URL filtering feeds, monitor for outbound connections to the identified IP, and enforce multi‑factor authentication for any DHL‑related services. Continuous re‑evaluation is advised as threat actors may modify hosting or page content.

Future investigations should track any changes to MX records, which currently list mx1.worldlibertyfinancialsystem.com, and observe any additional DNS or hosting modifications. Correlation with other wallet‑connect phishing incidents may reveal shared infrastructure or tooling, aiding attribution and mitigation.