wlfiethcrypto[.]com

The domain wlfiethcrypto.com was registered on August 18, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently offline. Infrastructure analysis shows the domain resolves to IP address 172.67.131.184, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The SSL certificate presented for the host is identified as "WE1," indicating a generic certificate rather than one tied to a legitimate organization. Reputation services assign extremely low trust scores: Scamadviser rates the site 1 out of 100 and Gridinsoft 0 out of 100, reflecting a high likelihood of malicious intent.

VirusTotal has recorded six positive detections out of ninety‑three scanning engines, confirming that multiple security vendors flag the domain as suspicious. The site appears on five known security blocklists and is actively blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. The page title retrieved from the site, "World Liberty Financial - Inspired by Trump, Powered by USD1," combined with the classification of the activity as a crypto scam, suggests a financial luring campaign that leverages political imagery to attract victims. The threat profile specifies brand impersonation of Binance, indicating that the malicious operators are likely attempting to harvest credentials or funds by masquerading as the well‑known cryptocurrency exchange.

While the site is currently taken offline, the infrastructure—particularly the use of a Cloudflare‑proxied IP and a generic SSL certificate—remains reusable for future campaigns. Defenders should continue to block the domain and associated IP, monitor for any re‑registration attempts, and enforce detection rules for traffic targeting Binance‑related login paths originating from the identified IP range. Additional investigation of the certificate details and the five blocklists may reveal further indicators of compromise that can be incorporated into broader threat‑intel feeds.