wlfi-finance[.]live

The domain wlfi-finance.live was registered on February 21, 2026 and is currently offline. DNS resolution points to the IP address 104.21.22.139, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title “World Liberty Financial - Shape the Future with our Governance Process,” suggesting a fabricated financial service. The threat profile classifies the site as a crypto‑scam that impersonates the Ethereum brand.

VirusTotal analysis recorded detections from two of ninety‑three scanners, indicating that at least a small subset of security engines flagged the domain as malicious. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, reinforcing its classification as a phishing or scam resource. The SSL certificate is identified as “WE1,” but no further certificate details are available. Because the site is offline, active content cannot be examined, and the exact phishing kit or payload remains unknown.

However, the combination of brand impersonation, a financial‑oriented page title, and the presence on multiple blocklists provides sufficient confidence to treat the domain as a high‑confidence malicious indicator. Defensive teams should add wlfi-finance.live to URL filtering and domain block lists, monitor for any future re‑hosting of the same IP or certificate, and consider correlating inbound traffic logs for connections to 104.21.22.139. Threat hunters should also query threat‑intel feeds for related hashes or campaigns that reference the Ethereum brand, as the infrastructure may be reused in other crypto‑related fraud operations. Continuous re‑evaluation is recommended in case the domain returns to service or additional analysis surfaces new artifacts.