wlfi-event[.]com

Analysis of wlfi-event.com, observed on July 24 2026, shows a brand‑impersonation campaign targeting Binance. The domain was registered on 17 August 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP 104.21.30.29, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site served an SSL certificate identified as WE1, indicating that TLS was enabled at the time of observation. The HTML title advertised “World Liberty Financial – Inspired by Trump, Powered by USD1”, which aligns with the reported crypto‑scam classification. The page content is not directly examined, but the title suggests a financial‑themed lure rather than a genuine Binance service.

Detection telemetry shows the domain is listed on two public security blocklists and has been actively blocked by the PhishDestroy and ScamSniffer filtering services. VirusTotal scans returned six positive detections out of ninety‑three submitted scanners, reinforcing the malicious assessment. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of abuse. The domain’s current status is offline, which may be the result of takedown actions or temporary hosting disruption.

Uncertainties remain regarding the full payload delivered to victims, the specific phishing kit employed, and whether any credential‑harvesting endpoints were active before the takedown. No additional intelligence such as OTX tags or Safe Browsing identifiers is available in the current dataset. Defenders should continue to block wlfi-event.com at perimeter filters, update URL reputation feeds with the observed IP and certificate fingerprint, and monitor for any resurgence of the same certificate or similar page titles. Incident response teams encountering Binance‑related credential requests should verify the host against the listed IP and registrar information, and consider informing Binance’s abuse team to aid in broader takedown coordination.