worldslibertyfinance[.]xyz

Analysis of worldslibertyfinance.xyz indicates that the domain was registered on 21 February 2026 and is currently offline. The site resolved to the IPv6 address 2606:4700:3037::6815:3bd3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The TLS certificate presented for the domain is identified as WE1, confirming the use of HTTPS. VirusTotal records show that three of ninety‑three scanning engines have flagged the domain as malicious, reflecting a modest but non‑trivial detection ratio.

The page title returned from the live site was “Et øjeblik …”, a phrase that does not disclose the targeted brand or service and therefore provides limited contextual clues. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. The threat classification is listed as generic phishing with an elevated risk rating. While the offline status prevents further live observation, the combination of a recent registration, Cloudflare hosting, partial vendor detections, and blocklist presence suggests a purposeful malicious campaign aimed at credential harvesting or similar illicit activity.

Defenders should continue to monitor DNS queries for the IPv6 address and enforce blocklisting of the domain in web filtering solutions. Given the limited detection count, additional sandbox or URL‑reputation checks are advisable if the domain reappears, and any inbound traffic from the associated IP should be scrutinized for anomalous behavior. Organizations using threat‑intelligence feeds should ensure that the domain is incorporated into their deny lists to mitigate potential exposure.