wlflibertyeth[.]xyz

Analysis of wlflibertyeth.xyz, which was taken offline, shows that the domain was registered on September 28 2025 through NiceNIC International Group Co., Limited. The authoritative nameservers finley.ns.cloudflare.com and gigi.ns.cloudflare.com resolve the name to 104.21.54.90, an address owned by Cloudflare (AS13335) located in the United States. No TLS certificate was presented, indicating that the site operated over plain HTTP when it was accessible. The sole visible page title, “רק רגע…”, is Hebrew for “just a moment…”, a phrase frequently used by malicious actors to delay user interaction.

The domain is classified as a crypto‑scam, and PhishDestroy has already added it to its block list. Independent scanning on VirusTotal recorded six positive detections out of ninety‑five engines, and the domain appears on one additional security blocklist. Gridinsoft assigned a trust score of 0 / 100, the lowest possible rating. These indicators collectively confirm that wlflibertyeth.xyz was used for phishing‑related activity targeting cryptocurrency users.

The current offline status prevents direct observation of payloads, so the exact content, credential‑capture mechanisms, or monetary addresses remain unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any future re‑registration, and consider adding the IP address 104.21.54.90 to threat‑intel feeds, even though Cloudflare hosts many legitimate services. Ongoing correlation with other Cloudflare‑hosted malicious domains may reveal shared infrastructure. Until the domain is observed again, the primary mitigation focus is on preventive blocking and alerting on any DNS resolution attempts.