m[.]worldlibertyfincial[.]com

PhishDestroy identifies m.worldlibertyfincial.com as an elevated-risk generic phishing domain that was designed to impersonate the World Liberty Financial platform and steal user credentials or financial information. The domain has since been taken offline, but its recent activity and infrastructure indicate a targeted threat against individuals seeking access to legitimate financial services.

This domain was created on June 23, 2025, through registrar Dynadot LLC, and resolves to IP address 198.134.116.29. It holds an SSL certificate issued by Let's Encrypt (R12), which may have lent it a false sense of legitimacy. VirusTotal analysis shows 3 out of 95 security vendors flagging the domain, and it currently appears on three separate security blocklists. The page title observed was "Access the Official World Liberty Financial Platform Safely | SearchAndHelp.com," a deceptive attempt to lure users into thinking they were visiting an official site.

Users who may have visited or interacted with m.worldlibertyfincial.com should immediately change passwords for any accounts used on the site and enable two-factor authentication wherever possible. Since this is a generic phishing threat, the primary risk is credential theft; therefore, monitoring financial accounts for unauthorized activity is advised. It is also recommended to report the domain to relevant cybersecurity authorities and ensure that any devices used to access the site are scanned for malware. Always verify URLs carefully before entering sensitive information, especially those mimicking well-known financial platforms.