wcridliberty[.]finance[.]app

Analysis as of July 25, 2026 indicates that the domain wcridliberty.finance.app resolves to the IP address 64.190.63.222, which is allocated to AS47846 SEDO GmbH in Germany. The domain is registered through Porkbun LLC and lists three Porkbun name servers: curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, and maceio.ns.porkbun.com. The page title observed during the brief capture reads "finance.app – Ce site web est à vendre ! – Ressources et information concernant finance".

No TLS certificate is presented, meaning the site was served over plain HTTP. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist while being explicitly blocked by PhishDestroy. VirusTotal reports that two of ninety‑five security vendors flagged the domain, reinforcing its classification as a generic phishing infrastructure. The current status is offline, so active payloads, credential‑harvesting forms, or specific phishing kits cannot be examined, leaving the exact victim‑target profile uncertain.

Defenders should block the resolved IP and the associated Porkbun name servers at the DNS level, add the domain to web‑filter deny lists, and monitor for newly registered sibling domains that share the same registrar or name‑server pattern. Logging and, where feasible, sinkholing traffic to the IP can capture residual malicious requests. Continuous re‑scanning on multi‑engine services is recommended in case the site reappears, and correlation with other feeds that reference the same blocklist or PhishDestroy entry may reveal broader campaign activity.