eligibility-worldlibertyfinance[.]com

Eligibility-worldlibertyfinance.com was observed resolving to the IPv4 address 188.114.97.3. The address belongs to AS13335 Cloudflare, Inc., located in the United States, and the domain is served through Cloudflare’s DNS with the authoritative nameservers daniella.ns.cloudflare.com and melnicoff.ns.cloudflare.com. The domain was registered on February 21, 2026 by the registrar listed as MAT BAO CORPORATION. An SSL certificate issued by Google Trust Services (WE1) is present, indicating HTTPS support, but the site returns a Cloudflare 522 “Connection timed out” status, as reflected in the page title “eligibility-worldlibertyfinance.com | 522: Connection timed out”.

VirusTotal analysis shows that five of ninety‑three scanning engines flagged the domain, and it appears on a single external blocklist. The threat intelligence community has already added the domain to the PhishDestroy blocklist, confirming its use in a generic phishing campaign. Current operational status is offline, suggesting the hosting has been taken down or the site is otherwise inaccessible, yet the infrastructure artifacts remain observable. Analysis indicates that the domain’s primary purpose was to host a phishing lure, leveraging Cloudflare’s performance and security services to obscure the true origin of the malicious content.

The presence of an active TLS certificate and the use of HTTP/3 further suggest an attempt to appear legitimate. While the site is presently unreachable, the underlying DNS configuration and IP association remain active and could be re‑used for future malicious deployments. Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering and threat‑intel feeds, and monitor for any re‑registration or changes to the DNS records. Continuous observation of Cloudflare‑related traffic to 188.114.97.3 is advised, as well as periodic re‑scanning of the domain should it become active again.