worldlibertyfinancial-unclaimed[.]com

The domain worldlibertyfinancial-unclaimed.com was registered on September 1, 2025 through Web Commerce Communications Limited dba WebNic.cc and resolves to the IP address 45.144.53.155, which is allocated to AS215730 H2NEXUS LTD in Finland. The site is presently taken offline, but historical evidence indicates it was used for a crypto‑related scam that impersonates the LinkedIn brand. The page title observed during its brief activity – "World Liberty Financial - Easily unlock your WLFI tokens" – aligns with a crypto token unlocking narrative and does not reference LinkedIn directly, suggesting the impersonation was limited to textual copy or metadata rather than full visual mimicry. Infrastructure signals reinforce the malicious assessment: the domain appears on a single security blocklist, has been flagged by PhishDestroy, and earned a Gridinsoft trust score of 0 / 100, indicating a high confidence of abuse.

The SSL certificate received an R12 rating, which is low and typically associated with suspicious or mis‑issued certificates. VirusTotal scans recorded ten detections out of ninety‑three participating vendors, providing independent confirmation of malicious activity. No additional public threat‑intel sources such as OTX or Safe Browsing entries were noted.

Defenders should immediately deny any network traffic to the IP 45.144.53.155, add the domain to local blocklists, and monitor for any resurgence or re‑registration of similar naming patterns. Given the brand‑impersonation intent toward LinkedIn, organisations should also alert their brand‑protection teams and consider reporting the domain to the LinkedIn abuse team for further takedown action. Continuous observation of the registrar’s future registrations is advisable, as the same registrar has been used for other abusive domains in the past.