VirusTotal
14 / 93
ReportInterpretation & limits
Engine detections from this stored analysis. Vendors and collection times may differ from other sources.
Domain security and threat intelligence
worldllbrteyflnance.online
“World Liberty Financial | Airdrop”
Threat verdict
CriticalDomain Appeal
Assessment sources
Assessment based on the stored source evidence below. Review sources →
Availability
Content unavailable
Content was unavailable in the latest observation
Observed · HTTP probe
Risk signals
VirusTotal detections: 14/93
Brand impersonation: Across
- Resolved IP
- 104.21.64.1
- Registered
- Feb 21, 2026
Additional indicators at a glance
VirusTotal
14 det.
URLScan
TLS Certificate
Expired or unverified
Age
8 mo
Observed status
Content unavailable
DestroyList
Listed
Source evidence
5 sourcesThese are dated observations, not a live safety check. No flag, a stored capture, or a completed analysis does not establish that a site is safe.
URLScan verdict
malicious
ReportInterpretation & limits
This is the recorded automated analysis. Completion alone is not a safety verdict.
OTX
no community references
ReportInterpretation & limits
Community publication references, not a vendor verdict or evidence of a common operator.
URLScan capture
stored report
Observation time not recorded
Report Interpretation & limits
A preserved page image documents what the collector received; a capture is not a safety verdict.
Google Safe Browsing
Checked; no threat flag recorded
ReportInterpretation & limits
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
Evidence Summary
Stored narrative · generated . Provider checks below retain their own observation dates.
The domain worldllbrteyflnance.online hosted a web page titled "World Liberty Financial | Airdrop," impersonating a brand across the cryptocurrency sector. This site posed a threat as a cryptocurrency scam, likely designed to deceive users into interacting with a fraudulent airdrop scheme, potentially leading to financial loss or theft of digital assets.
Technical analysis confirms malicious activity. VirusTotal flagged the site with 14 detections out of 95 security vendors. It was flagged by ChainPatrol, alphaMountain.ai, BitDefender, CRDF, and CyRadar, and appeared on 1 blocklist. The domain is hosted on IP address 104.21.64.1, registered in the United States under AS13373 Cloudflare, Inc. It was created on February 21, 2026, and uses an SSL certificate identified as WE1.
The site is currently down or offline. Its domain risk score is 80, indicating a high level of threat. Based on the evidence, this domain represents a significant risk and should be avoided.
Extracted from stored page analysis
1 wallet · 1 Telegram
Observed indicators
Full extracted values, their blockchain and collection source. An address found in page content does not establish who controls it.
0xdA5e1988097297dCdc1f90D4dFE7909e847CBeF6Format validated · Domain analysishttps://t.me/defiant1sStored page referenceIoC extraction recorded 2026-08-02 04:04:16 UTC
Detection-evasion analysis
Cloaking and traffic-distribution check
Not observed
No cloaking was observed in the stored scan
Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.
- Stored cloaking flag
- Not observed
- Cloaking score
- 0/6
- Last cloaking scan
Scanner note: unavailable: raw=connection_error; http=0; via=http_proxy; error=SOCKSHTTPConnectionPool(host='worldllbrteyflnance.online', port=80): Max retries exceeded with url: / (Caused by NewConn
Live TDS fingerprint check
Seven Keitaro fingerprints plus a crawler-versus-browser comparison, run from the PhishDestroy scanner when this panel is open.
Waiting
Network & certificates
Stored technical evidenceNetwork & DNS
Shared CDN edge- Resolved IP
- 104.21.64.1
- Network ASN
- AS13335
- Organization
- Cloudflare, Inc.
- Observed location
- San Francisco, US
- Server header
- cloudflare
Edge-IP reputation is not attributed to this domain.
Location describes the IP network.
TLS certificate
- Issuer
- WE1
- Hostname coverage
- Hostname coverage not recorded
- Collection source
- PhishDestroy collector
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest Classified Outcome 2026-10-14 20:21:26 UTC
Primary outcome
DNS inactive
reason: DNS NXDOMAIN 80% confidence
Attribution
source: Dns Cache
Evidence layers
Availability: DNS inactive
Content: Unreachable
DNS: NXDOMAIN
Registration: Unknown
Latest HTTP observation
Unknown Probe Inconclusive 20% 2026-10-15 01:09:41 UTC
RDAP registration
Unknown
Observed timeline
last reachable: 2026-04-22 23:10:07 UTC current episode first observed: 2026-09-30 16:14:55 UTC observed RIP window: 2026-04-22 23:10:07 UTC → 2026-09-30 16:14:55 UTC · 3,857.08h midpoint estimate ≈ 2026-07-12 07:42:31 UTC · precision very low · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Report This Domain
Submit evidence & help protect others
VirusTotal Analysis
14 / 93 security vendors flagged this domain
View on VT
Last analyzed
ChainPatrol
alphaMountain.ai
BitDefender
CRDF
CyRadar
Forcepoint ThreatSeeker
Fortinet
G-Data
Google Safebrowsing
Gridinsoft
Lionic
Seclookup
SOCRadar
Sophos
Threat Response Pipeline
Discovery
Analysis
Monitoring
10 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
Threat Ingested
worldllbrteyflnance.online detected and queued for full analysis
URLScan.io Capture
Stored URLScan report with capture artifacts
URLScan Verdict
URLScan returned a malicious verdict · score 100
VirusTotal
14/93 recorded on VirusTotal
Brand Impersonation
Impersonation of Across
Forensic Evidence Collected
Stored evidence from URLScan.io, stored screenshot
Technical Analysis Recorded
The report contains stored technology or forensic-analysis results.
DestroyList Published
Listed in the public PhishDestroy/DestroyList repository
Content Observed Unavailable
The latest stored checks indicate that the reported content is unavailable; this does not establish who or what caused the change.
Time to First Unavailability
1071 hours elapsed from detection to the first unavailable observation.
How we investigate & report
Public scans, evidence and abuse channels
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups
urlscan.io
Screenshot · DOM · HTTP
Capture the rendered page, requests and visible infrastructure.
VirusTotal
Multi-engine verdicts
Compare the available engine results and retain the analysis timestamp.
Google Safe Browsing
Transparency Report
Check whether Google currently lists the URL as unsafe.
Cloudflare Radar
DNS · certificates · categories
Inspect a public scan and its recorded network and classification data.
AlienVault OTX
Threat-intelligence pulses
Look for indicator references and related community intelligence.
Wayback Machine
Historical evidence
Compare archived captures and preserve historical context.
abuse.ch ThreatFox
IOC correlation
Look for matching indicators and associated threat records.
crt.sh
Certificate Transparency
Inspect certificate records and related hostnames.
DNS Security Filters
Quad9 · AdGuard · CleanBrowsing
Compare security resolver responses and record observed blocking.
Web-Check
Surface inspection
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels
- Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
- Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
- Send the report. Keep outgoing report records and recipient information when available.
- Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
GoogleSafe Browsing↗
GoogleWeb Risk↗
MicrosoftSmartScreen↗
VirusTotalURL analysis↗
CloudflareRadar / abuse reporting↗
YandexSafe Browsing↗
URLScan.ioPublic scan↗
ESETSample / URL submission↗
BitdefenderURL submission↗
NortonSafe Web↗
SymantecSiteReview↗
AviraURL reporting↗
Avast / AVGURL reporting↗
KasperskyOpenTIP↗
Dr.WebOnline scanner↗
NetcraftAbuse reporting↗
PhishTankCommunity reporting↗
APWG eCXPhishing intelligence↗
PhishStatsPublic feed↗
Phish.ReportHosting abuse↗
SpamhausDomain reputation↗
PolySwarmMulti-engine analysis↗
CheckPhishURL scan↗
QutteraMalware scan↗
URLqueryBrowser analysis↗
Criminal IPAsset intelligence↗
CRDFThreat Center↗
ScamadviserReputation check↗
MyWOTCommunity reputation↗
Community reports
Reported by 1 community member, first seen Sep 11, 2025
- Stored reports
- 1
- Unique reported URLs
- 1
Accepted1
Evidence & External Reports
Security Analysis
OSINT & Intelligence
DNS & Network
SEO & Domain
Deep Analysis
Were You Affected by This Site?
3 evidence signal groups linked
0 reports recorded
Content unavailable
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Action Fraud
Report fraud and cybercrime in England, Wales and Northern Ireland
Contact centre0300 123 2040
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
97-country directory
Template-based draft · optional AI wording assistance requires separate consent
Template-based draft • optional AI wording assistance requires separate consent · Review and submit it yourself
Related Infrastructure & Reports
- Direct link Shares a registration or an identical phishing kit.
- Supporting signal Shares infrastructure or a target brand; not proof of one operator.
- Discovery only Listed for navigation; no shared attribute with this host.
Each lane is one reason a domain is linked to this host. Node size marks VirusTotal detections and dashed nodes are already offline. The full lists follow below.
Content matches 4
Same favicon hash or the same page title as this host.
Airdrop Scam kit 8
Part of the Airdrop Scam phishing campaign. View all campaign domains →
Other reports on shared Cloudflare edge 6
Shared edge IP; unrelated tenants may be present.
Across impersonation 8
These domains also target Across users. View all Across threats →
Recent threat reports 4
Recently added threat reports.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive