worldlibertyfinanced[.]com

Analysis of worldlibertyfinanced.com, created on July 05, 2025 and registered through PDR Ltd. d/b/a PublicDomainRegistry.com, shows a pattern consistent with malicious infrastructure. The domain resolves to IP address 172.67.136.156, an address owned by AS13335 Cloudflare, Inc. in the United States, and is served behind Cloudflare’s edge network using HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 designation, indicating a legitimate‑looking TLS termination that masks the underlying host.

HTTP probing returned a 200 status code with the page title "Just a moment...," a typical Cloudflare interstitial page that can be abused to hide malicious content. The domain is listed on one security blocklist and has been specifically blocked by PhishDestroy, confirming that threat‑intelligence feeds have identified it as malicious. VirusTotal reports five detections out of ninety‑five scanners, reinforcing the suspicion of abuse.

No evidence of safe‑browsing or OTX entries is present, and the site has been taken offline as of the report date, July 25, 2026. Defenders should continue to block the domain at perimeter defenses, monitor for other Cloudflare‑hosted domains that resolve to the same IP range, and consider adding the IP address to reputation‑based deny lists. Ongoing observation of new registrations using the same registrar may reveal further campaigns employing similar tactics.