wolrdlibartyfinancial[.]xyz

Analysis of wolrdlibartyfinancial.xyz shows that the domain is currently offline but retains indicators of a recent phishing operation. The domain was registered on February 21, 2026 and resolves to the IP address 104.21.8.189, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Cloudflare hosting is frequently leveraged by threat actors to hide infrastructure, and the IP is shared with numerous unrelated services, reducing the usefulness of host‑based reputation alone. The site presents a page title of "Nur einen Moment…", a German phrase meaning "Just a moment…", which is commonly used in fraudulent pages to suggest a loading delay before a credential capture form appears.

The SSL certificate is identified as "WE1", confirming that TLS is active but offering no additional trust. VirusTotal analysis recorded 11 detections out of 93 scanning engines, indicating that multiple security vendors have flagged the domain for malicious behavior. The domain also appears on one public security blocklist and is listed by PhishDestroy as a blocked phishing source.

These data points collectively confirm that the domain has been used for phishing, though the exact target brand or payload details are not disclosed in the available intelligence. Defenders should add wolrdlibartyfinancial.xyz to DNS and web‑filter blocklists, monitor for any outbound connections to the associated Cloudflare IP, and consider correlating internal logs for attempts to resolve or contact the domain. Continuous observation of future DNS queries for this domain or related subdomains is advised, as threat actors may reactivate or repurpose the registration.