worldlibertfinancial[.]com

The domain worldlibertfinancial.com has been flagged as a high‑risk generic phishing site. The page returns an HTTP 200 response and presents a title identical to the domain name, a pattern commonly used to deceive victims into believing the site is legitimate. The TLS certificate is issued by GoDaddy.com through the GoDaddy TLS Intermediate CA DV – R1v1, which does not provide any indication of malicious intent beyond the fact that the certificate is publicly available.

Infrastructure analysis shows the domain resolves to the IPv6 address 2a01:7e01::f03c:95ff:fe00:2692, which is routed through AS63949, listed as Akamai Connected Cloud in Germany. The domain was created on February 21 2026 and is hosted by a TLD Registry registrar for the .com top‑level domain. Gridinsoft assigns the host a trust score of 0 out of 100, reflecting an extremely low confidence level in the site’s safety.

Detection services have begun to block the site. PhishDestroy lists the domain on its blocklist, and the domain appears on one additional security blocklist. VirusTotal reports that 2 out of 95 scanned security vendors raise a detection for the domain, indicating that at least a minority of scanners have identified malicious characteristics. No further intelligence regarding payloads, credential‑harvesting forms, or related command‑and‑control infrastructure is currently available.

Defenders should treat any traffic to worldlibertfinancial.com as hostile. Network controls ought to block outbound connections to the IPv6 host and to the domain name itself. Users must be warned that the site is actively serving phishing content and that credential entry on the page is likely to result in account compromise. Continuous monitoring for new detections and additional blocklist listings is recommended to maintain situational awareness.