worldlibertyfinacial[.]lol

worldlibertyfinacial.lol was registered on 21 February 2026 and is presently marked as offline. The domain resolves to the IP address 104.21.48.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. TLS inspection shows the site served a certificate identified as WE1, indicating a publicly‑trusted SSL deployment. The page title returned by the server reads “World Liberty Financial – Where DeFi Meets TradFi,” suggesting a focus on decentralized‑finance services.

Threat intelligence attributes the site to a crypto‑scam campaign that masquerades as LinkedIn, classifying the activity as brand impersonation targeting LinkedIn users. VirusTotal analysis recorded four positive detections out of ninety‑three scanners, confirming that multiple security engines observed malicious characteristics. The domain is listed on four independent blocklists – PhishDestroy, Polkadot, Enkrypt, and Codeesura – reinforcing its reputation as a hostile indicator. No additional public reports or sandbox analyses are currently available, and the site’s offline state limits further behavioral observation.

Defenders should add worldlibertyfinacial.lol and its associated IP 104.21.48.1 to network‑level deny lists and ensure that any outbound connections to Cloudflare edge nodes serving this domain are inspected for anomalous payloads. Continuous monitoring of the domain’s registration status and re‑appearance on threat feeds is recommended, as the underlying infrastructure could be reused for future impersonation attempts. Correlation with other LinkedIn‑targeted phishing incidents may reveal shared command‑and‑control patterns or credential‑harvesting modules. Prompt detection and isolation remain essential to mitigate the risk posed by this elevated‑level impersonation campaign.