Skip to security report
Analytics Dashboard
Domain security and threat intelligence
allocation-worldlibertyfi.online favicon

allocation-worldlibertyfi.online

“World Liberty Financial - Shape the Future with our Governance Process”

Threat verdict Critical 90/100 evidence score
Availability Content unavailable Content was unavailable in the latest observation
Risk signals
VirusTotal detections: 6/93 Stored blocklist matches: 1 Brand impersonation: Binance
Feb 26, 2026 Binance CDN
Actions API
⚠️
This domain has been flagged as malicious
Security engines reporting a detection: 6. Public blocklists reporting a match: 1. Exercise extreme caution — do not enter credentials or personal information.

Evidence Summary

CRITICAL
Score
90/100

allocation-worldlibertyfi.online was registered on 21 February 2026 and is currently taken offline. The domain resolves to the IP address 104.21.12.252, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title “World Liberty Financial – Shape the Future with our Governance Process,” suggesting a financial‑themed front‑end that is unrelated to the legitimate Binance brand. Intelligence indicates that the domain is being used for a crypto‑related scam that attempts to impersonate Binance, although the exact phishing flow has not been captured. VirusTotal analysis shows that six of ninety‑three scanning engines flagged the domain as malicious, providing early confirmation of suspicious activity.

Independent blocklist services PhishDestroy and ScamSniffer have added the domain to their watchlists, and two additional security blocklists also list the domain, reinforcing the consensus that it should be treated as hostile. The SSL certificate associated with the host is identified as “WE1,” which does not correspond to a trusted certificate authority and further weakens the site’s credibility. Because the domain is offline, live HTTP response codes, content hashes, and Safe Browsing verdicts cannot be verified at this time. No public OTX indicator has been published for this host, and the registrar information has not been disclosed in the available data set. Consequently, the precise attack vector—whether a credential‑harvesting login page, a malicious download, or a redirect to a secondary payload—is still unknown.

Defenders should immediately block any outbound connections to 104.21.12.252 and add allocation-worldlibertyfi.online to DNS‑based deny lists. Email security gateways should be configured to flag messages that reference Binance and contain links to this domain.

VirusTotal
VirusTotal
6 det.
URLScan
URLScan
Report ↗
TLS Certificate
Expired or unverified
Age
7 mo
Observed status
Content unavailable
PhishDestroy
DestroyList
Listed
Data coverage VirusTotal 6 / 93 OTX no community references URLScan capture stored report URLScan verdict malicious TLS Expired or unverified WHOIS 7 mo old Screenshot 2 captures · 2 sources

Threat Response Pipeline

Discovery
Checks
Reports
Availability
12/13

Public Blocklist Status

Detection-evasion analysis

Cloaking and traffic-distribution check

Not observed No cloaking was observed in the stored scan

Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.

Stored cloaking flag
Not observed
Cloaking score
0/6
Last cloaking scan

Scanner note: dns_error: raw=dns_error; via=local_dns_prefilter

Live TDS fingerprint check
Seven Keitaro fingerprints plus a crawler-versus-browser comparison, run from the PhishDestroy scanner when this panel is open.
Waiting

Stored Capture · 2 sources

Primary capture 1 / 2
SourcePrimary capture
Captured2026-02-26 22:19 UTC
StateStored capture
Position1 / 2
View Full Size Open raw image Wayback Download

Domain Intelligence

Domain
URLScan Verdict Malicious score 100 Phishing brand: Worldliberty report ↗
Telegram IoCs 1 extracted https://t.me/defiant1s
Server / ASN cloudflare · AS13335 CLOUDFLARENET, US
IP Context Cloudflare shared edge origin IP hidden Edge-IP reputation is not attributed to this domain.
IP Address 104.21.12.252 CDN
GeoUS San Francisco, US
NetworkAS13335 · Cloudflare, Inc.
Reverse IPviewdns.info → rapiddns.io →
The origin IP is hidden behind a CDN proxy. Reverse-IP results for the edge address contain unrelated tenants; finding the origin requires passive DNS or certificate-transparency data.
RegistrationCreated Feb 21, 2026 (213d)
Time to First Unavailability 41 days
What we count Elapsed time from the first stored abuse report to the first observation that the content was unavailable. This does not establish the cause.
What each report contains Stored outgoing-report records may reference evidence available at the time, such as vendor verdicts, registration data, hosting details, classifications, or screenshots. This page does not infer the exact payload delivered, receipt, acknowledgement, or action by a recipient.
Technical detailsDNS, SSL SANs, timestamps
First DetectedFeb 26, 2026
DOM Analysisanalyzed Mar 24, 2026score 70/1007 brand signals
IoC Extractionscanned Aug 2, 20260 wallet · 1 Telegram IoC
Page Title
World Liberty Financial - Shape the Future with our Governance Process
Impersonates
Binance Coinbase LinkedIn MetaMask Signal Telegram Trust Wallet
TLS Certificate
Expired or unverified · Issued by WE1
Report This Domain Submit evidence & help protect others

VirusTotal Analysis

6 / 93 security vendors flagged this domain
View on VT
Last analyzed
ChainPatrol
alphaMountain.ai
CRDF
Fortinet
G-Data
Seclookup

Lookalike domains

187 stored lookalike domains

binanceb.com addition Internal report binancej.com addition Internal report binanceo.com addition Internal report binancep.com addition Internal report binanceu.com addition Internal report binancet.com addition Internal report binancev.com addition Internal report binancez.com addition Internal report benance.com vowel-swap bi.nance.com subdomain biannce.com transposition bin1nce.com replacement
Show all (88)
binabce.com replacement binacne.com transposition binan.ce.com subdomain binancecom.com various binanci.com vowel-swap binanco.com vowel-swap binancr.com replacement binancs.com replacement binancw.com replacement binande.com replacement binanfe.com replacement binanve.com replacement binanxe.com replacement binnace.com transposition binonce.com vowel-swap binsnce.com replacement binunce.com vowel-swap binynce.com replacement binznce.com replacement bniance.com transposition bunance.com replacement ibnance.com transposition ninance.com replacement b-inance.com hyphenation b8inance.com insertion b8nance.com replacement b9nance.com replacement bbinance.com repetition bhinance.com insertion bi-nance.com hyphenation biance.com omission bibance.com replacement bibnance.com insertion bihance.com replacement bihnance.com insertion biinance.com repetition bijnance.com insertion biknance.com insertion bimance.com homoglyph bimnance.com insertion bin-ance.com hyphenation binaance.com repetition binabnce.com insertion binace.com omission binahce.com replacement binamnce.com insertion binan-ce.com hyphenation binanbce.com insertion binanc-e.com hyphenation binanc.com omission binanc3.com replacement binancce.com repetition binancve.com insertion binancxe.com insertion binancz.com replacement binandce.com insertion binane.com omission binanec.com homoglyph binanhce.com insertion binanmce.com insertion binannce.com homoglyph binanvce.com insertion binanxce.com insertion binarnce.com homoglyph binasnce.com insertion binawnce.com insertion binbance.com insertion binhance.com insertion binmance.com insertion binnance.com homoglyph binnce.com omission binqance.com insertion binsance.com insertion binwnce.com replacement binyance.com insertion bionance.com insertion birnance.com homoglyph biunance.com insertion bjnance.com replacement bnance.com omission bninance.com insertion boinance.com insertion bonance.com replacement buinance.com insertion bvinance.com insertion clinance.com homoglyph dinarce.com homoglyph ginance.com replacement

Showing 100 of 187

Community reports

Reported by 1 community member, first seen Aug 21, 2025

Stored reports
1
Unique reported URLs
1
Accepted1

Evidence & External Reports

Security Analysis
URLScan Malicious VirusTotal 6 det. ChainPatrol URLQuery Open lookup SSL Labs Expired/unverified WOT ScamAdviser Blacklist Checker URLVoid Sucuri SiteCheck MDN Observatory
OSINT & Intelligence
Web-Check Full scan SOCRadar Dark web report LeakIX Leak search Shodan Censys ThreatFox Hudson Rock Sign-in search IntelX crt.sh Certs WHOIS Wayback
DNS & Network
nslookup.io DNS bgp.tools ASN/Route
SEO & Domain
SpyFu Moz DA/PA Ahrefs Backlinks Deep Analysis

Were You Affected by This Site?

If credentials were compromised, report immediately. Do not engage with recovery scammers.

If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.

Europol
Find the official reporting channel for your EU country
National police directory
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →

Report to Your Local Authorities

Select your country to get official cybercrime contacts, or create a complaint draft →.

97-country directory
Template-based draft • optional AI wording assistance requires separate consent Review and submit it yourself

Check Any Domain

Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence

Scan Now

Report Phishing

Submit suspicious domains to our threat database — protect the community

Report

Live Threat Feed

Recent phishing reports and observed availability changes

Monitor

Stay Informed, Stay Safe

Monitor live threats or contest this listing if you believe it's a false positive

Live Threat Feed Appeal This Listing
HTML · IFRAME

Embed This Report

Share this threat intelligence on your website or blog

embed.html 
<iframe
  src="https://phishdestroy.io/embed/domain/allocation-worldlibertyfi.online"
  title="PhishDestroy threat report for allocation-worldlibertyfi.online"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>