wlficoineth[.]com

Analysis of wlficoineth.com indicates a crypto scam domain targeting Binance users, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, and resolves to IP 104.21.63.94, hosted on Cloudflare's network (AS13335). Infrastructure review shows an SSL certificate issued by WE1, a common low-assurance provider. The page title 'World Liberty Financial - Inspired by Trump, Powered by USD1' suggests an attempt to leverage political branding alongside financial themes, though the exact content and functionality remain unconfirmed due to the domain's offline status.

Defenders should note that five security blocklists and multiple detection vendors—including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have flagged this domain. VirusTotal records show 6 of 95 security vendors marking it as malicious, though this does not represent a full consensus. The domain's association with crypto-related fraud aligns with its classification as a 'Crypto Scam' in available threat intelligence. Given the domain's offline status, immediate risk to end users is reduced, but defenders should treat it as a known malicious indicator.

Network-level blocks at the IP and domain level are recommended for organizations handling cryptocurrency or financial transactions. Security teams should monitor for re-activation or related domains using similar naming patterns (e.g., 'wlficoin', 'libertyfinancial'). No evidence currently links this domain to a specific phishing kit or advanced evasion techniques, but its use of Cloudflare hosting is consistent with threat actor infrastructure designed to obscure origin servers.