wlfilibertyfinances[.]xyz

PhishDestroy has identified the domain wlfilibertyfinances.xyz as a high-risk generic phishing threat, specifically designed to mimic the World Liberty Financial platform. This phishing site exploits the association with Donald Trump and the USD1 stablecoin to lure victims into revealing cryptocurrency credentials or sensitive financial information. The domain is now offline, but its past activity poses a significant risk to users who may have encountered it.

Technical analysis reveals that this domain was created on February 21, 2026, and resolves to the IP address 172.67.205.21. It is listed on five security blocklists, and VirusTotal reports that 12 out of 95 security vendors flagged it as malicious. The SSL certificate used is of type WE1, which is not a widely recognized certificate authority, further indicating suspicious intent. These indicators, combined with its short lifespan and targeted branding, confirm a deliberate phishing operation aimed at cryptocurrency users.

Users who have visited wlfilibertyfinances.xyz should immediately change any passwords or wallet keys entered on the site and enable two-factor authentication on all financial accounts. Since this is a generic phishing threat, the primary risk is credential theft and unauthorized access to crypto wallets. PhishDestroy recommends running a full antivirus scan and monitoring accounts for unusual activity. No legitimate financial platform would request sensitive information through such a domain, and users should always verify URLs before engaging.