worldlibertyfinacials[.]xyz

Analysis indicates that the domain worldlibertyfinacials.xyz was registered on 21 February 2026 and currently resolves to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The site presented the page title “Nur einen Moment…”, suggesting a temporary holding page, but no further content has been captured. The SSL certificate presented is identified as “WE1”, confirming that TLS is in use but providing no additional validation of legitimacy. On VirusTotal the domain received six positive detections out of ninety‑three scanning engines, indicating that a minority of security products have flagged it as malicious.

It appears on one external blocklist and has been explicitly blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain is classified as generic phishing and the overall risk level is elevated. The service is presently offline, which limits real‑time observation of its behavior.

Defenders should continue to block any outbound connections to 188.114.97.3 and add worldlibertyfinacials.xyz to URL filtering policies. Monitoring of Cloudflare‑hosted infrastructure for similar domains created after February 2026 is recommended, as the rapid creation and takedown pattern suggests a short‑lived phishing campaign. Because the page content has not been fully analysed, analysts should treat any future re‑appearance of the domain as suspect until a thorough content review can be performed.