check[.]eligibility-wlfi[.]xyz

This domain, check.eligibility-wlfi.xyz, is flagged for brand impersonation targeting Binance, a major cryptocurrency exchange. The site presents itself under the title 'World Liberty Financial - Inspired by Trump, Powered by USD1,' which does not align with Binance’s official branding or services. Analysis indicates the domain was likely designed to deceive users into believing they are interacting with a legitimate financial platform, potentially leading to credential theft or unauthorized transactions. Infrastructure analysis reveals the domain was registered on February 21, 2026, and resolves to the IP address 172.67.171.250, hosted on Cloudflare’s network (AS13335). Detection metrics show 13 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain appears on two security blocklists and is associated with an SSL certificate issued by WE1. Google Safe Browsing does not currently list the domain, but its offline status suggests mitigation efforts may have been enacted. As of the latest assessment, check.eligibility-wlfi.xyz has been taken offline, reducing immediate exposure risk. However, the domain’s infrastructure remains registered, and similar campaigns may re-emerge under altered domains or IPs. Users are advised to verify the authenticity of financial platforms by cross-referencing official domains and avoiding interaction with unsolicited or untrusted links. Monitoring for renewed activity under related naming conventions is recommended.