wolrdlibertyflnancials[.]xyz

Analysis of wolrdlibertyflnancials.xyz, observed as offline on 24 July 2026, indicates that the domain was registered on 21 February 2026 and subsequently used for a generic phishing campaign. The site resolved to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., placing the hosting infrastructure in the United States. The SSL certificate presented for the domain is identified as WE1, confirming that HTTPS was available at the time of observation. The page title returned by the server is the Hebrew phrase “רק רגע…”, which does not correspond to any known legitimate brand or service and further supports the malicious intent.

VirusTotal scans show that eight of ninety‑three security vendors flagged the domain, demonstrating a moderate level of detection across independent scanners. The domain also appears on a single security blocklist and is listed by PhishDestroy as a blocked phishing resource. These independent indicators corroborate the classification of the domain as a phishing vector. Because the domain is currently offline, real‑time interaction is not possible, but the historical evidence suggests that the site was intended to harvest credentials or personal information.

The lack of additional intelligence, such as Safe Browsing or Open Threat Exchange references, leaves the full scope of the campaign uncertain. Defenders should continue to block the domain at network perimeter devices, update DNS filtering policies to include the domain, and monitor for any future re‑registration or similar patterns that reuse the same hosting provider or SSL certificate fingerprint. Investigators should also query historical DNS records to determine any prior resolutions that may reveal additional malicious infrastructure associated with the domain. Ongoing vigilance is recommended, especially for organizations that may be targeted by phishing campaigns employing Hebrew language cues.