worldliberty-fin[.]com

Analysis of the domain worldliberty-fin.com indicates it is a confirmed phishing site targeting financial services, currently offline as of July 25, 2026. The domain was registered on February 21, 2026, through MAT BAO CORPORATION, a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.144.158, hosted on Cloudflare's infrastructure (AS13335), a common tactic to obscure the true origin of malicious traffic. The domain employs Cloudflare nameservers (fattouche.ns.cloudflare.com and jo.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which does not inherently validate legitimacy but may lend a false sense of security to potential victims. Security vendor detections are limited but notable: four of ninety-three engines on VirusTotal flagged the domain as malicious at the time of assessment.

Additionally, the domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, which specialize in financial and cryptocurrency-related threats. Gridinsoft assigns a trust score of 0/100, further corroborating its classification as high-risk. The page title, 'Welcome,' offers no specific branding or service details, though the domain name suggests an attempt to impersonate a financial or investment platform. Defenders should treat this domain as compromised and avoid any interaction.

Network-level blocking is recommended for organizations, particularly those in the financial sector, given the domain's inclusion on MetaMask's blocklist. While the site is currently offline, historical DNS records and WHOIS data should be preserved for potential forensic analysis. No evidence links this domain to a specific phishing kit or targeted brand, though its structure and detection profile align with generic financial phishing campaigns. Further investigation may reveal additional infrastructure or affiliate domains registered through the same registrar.