worldlibirtyfiancials[.]xyz

Analysis indicates that the domain worldlibirtyfiancials.xyz was registered on 21 February 2026 and subsequently resolved to the Cloudflare‑owned address 172.67.199.52, which is associated with ASN 13335 in the United States. The site returned a HTTP response containing the title “Just a moment…”, and its SSL certificate is identified as “WE1”. Threat intelligence from PhishDestroy confirms that the domain has been taken offline, and it is currently listed on a single security blocklist.

VirusTotal records show that two of ninety‑five scanning engines flagged the domain, suggesting malicious behavior consistent with generic phishing. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the high‑risk assessment. The combination of a newly created domain, Cloudflare front‑end, low trust score, and detection by multiple vendors points to an active phishing infrastructure that was recently deployed and subsequently disrupted.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no additional content analysis is available. Defenders should continue to block the IP address 172.67.199.52 and the domain itself at perimeter defenses, monitor for re‑registration or similar aliases hosted on the same Cloudflare ASN, and incorporate the observed indicators into threat‑intel feeds. Ongoing observation of Cloudflare‑hosted domains created after February 2026 is recommended to detect potential replicas.