worldllbertyfinanclal[.]com

Analysis of worldllbertyfinanclal.com, created on 06 September 2025, shows an active generic phishing infrastructure that remains live as of 24 July 2026. The domain resolves to 172.67.220.242, an address owned by AS13335 Cloudflare, Inc. located in the United States. Cloudflare is also the DNS provider, with authoritative nameservers thomas.ns.cloudflare.com and desi.ns.cloudflare.com, confirming that the site is fronted by Cloudflare’s edge network. TLS termination is handled by Google Trust Services under the WE1 certificate, providing a valid HTTPS certificate typical of Cloudflare‑managed sites. HTTP requests return a 200 status code, but the page title reported is “404 Not Found”, indicating that the site may be serving a placeholder page or that the malicious content is delivered only under specific conditions.

The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal data shows nine of ninety‑five scanners flagging the domain, reinforcing the suspicion of malicious activity. Registration was performed through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar frequently observed in abusive domain registrations. Detected technologies include Cloudflare Browser Insights, Cloudflare services, and HTTP/3, all of which are common in legitimate traffic but are also leveraged by threat actors to obscure origin and improve performance.

No additional intelligence such as Safe Browsing entries, Open Threat Exchange reports, or detailed payload analysis is currently available, leaving the exact phishing vector and targeted brand undefined. Defenders should immediately add the domain to DNS‑level blocklists, monitor outbound traffic for connections to the associated IP address, and enforce URL filtering policies that deny access to the domain. Ongoing re‑scanning on VirusTotal and periodic inspection of the HTTP response are advised to capture any future activation of the phishing campaign.