unlock-worldlibertyfinancial[.]xyz

Analysis indicates that unlock-worldlibertyfinancial.xyz was registered on 21 February 2026 and immediately pointed to the Cloudflare‑provided address 104.21.112.1, which belongs to ASN 13335 in the United States. The use of Cloudflare’s reverse‑proxy service is a common tactic for phishing operators because it masks the true origin of the web server and provides built‑in DDoS mitigation. The domain’s SSL certificate is identified as “WE1”, which does not correspond to a publicly trusted CA and suggests a self‑signed or low‑trust certificate often seen on malicious sites. VirusTotal records show that 14 of 95 scanning engines flagged the domain, confirming that multiple independent security products have observed malicious behavior associated with the host.

Two dedicated anti‑phishing blocklists, PhishDestroy and ScamSniffer, already list the domain, and it appears on two additional security blocklists, further reinforcing the consensus that the domain is being used for phishing‑related activity. The current operational status is reported as offline, indicating that the hosting service has taken the site down or the operator has ceased serving content. Nevertheless, the infrastructure components remain in place and could be re‑activated. Defenders should continue to block the domain at DNS and proxy layers, monitor the IP address for any future content changes, and add the host to internal threat‑intel feeds.

Ongoing observation of Cloudflare‑associated IPs that resolve to the same address is recommended, as attackers frequently rotate domain names while retaining the same backend infrastructure. Because the domain was created only a few months ago, its rapid appearance on multiple blocklists suggests a targeted campaign rather than an isolated test. Until the domain is confirmed clean, it should be treated as malicious and prevented from reaching end users.