lockbox-worldslibertyfinancial[.]com

The domain lockbox-worldslibertyfinancial.com was registered on August 26, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently taken offline. DNS resolution points to the IP address 104.21.96.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a page title of "World Liberty Financial - Easily unlock your WLFI tokens" and claimed to target LinkedIn users, indicating a brand‑impersonation tactic that aligns with a crypto‑scam narrative. The SSL certificate presented as "WE1," but no further certificate details are available.

Reputation metrics show a Gridinsoft trust score of 0 out of 100, reflecting a complete lack of trust. VirusTotal analysis recorded seven positive detections out of ninety‑three security vendors, confirming malicious classification by multiple scanners. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. No additional public threat‑intel sources such as OTX or Google Safe Browsing entries were reported.

The observable evidence suggests the infrastructure relies on Cloudflare’s CDN, a common choice for fast‑hosting but also for obscuring true origin. Defenders should continue to block the domain at perimeter filters, update URL reputation lists with the observed IP and ASN, and monitor for any re‑registration attempts that reuse the same registrar or similar naming patterns. Continued observation of related domains that reference "World Liberty Financial" or the WLFI token terminology is recommended, as the campaign may evolve to target other platforms or deploy new phishing pages.