wlflibertydrop[.]xyz

Analysis of wlflibertydrop.xyz indicates that the domain is currently offline but exhibits multiple indicators of malicious intent. The site presented the page title “Un momento…” and was hosted on IP 188.114.97.3, which belongs to Cloudflare’s AS13335 network located in the United States. The domain was registered on 26 September 2025 through NiceNIC International Group Co., Limited and uses Cloudflare nameservers coen.ns.cloudflare.com and saanvi.ns.cloudflare.com. No TLS certificate was observed, meaning the site served HTTP only.

Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed on at least one public blocklist. VirusTotal scans reported that 7 of 95 antivirus and URL‑reputation engines flagged the domain as malicious, reinforcing the suspicion of phishing activity. PhishDestroy has also blocked the domain. The combination of a low trust score, lack of encryption, presence on a blocklist, and multiple vendor detections suggests that wlflibertydrop.xyz was employed for generic phishing, likely aimed at harvesting credentials or delivering malicious payloads.

Because the site is already taken offline, immediate containment actions are limited to ensuring that any cached or redirecting infrastructure is also blocked. Defenders should add the domain and its resolved IP address to deny‑list rules, monitor for any future re‑registration or similar Cloudflare‑hosted domains, and verify that internal security gateways continue to flag the domain in URL filtering policies. Ongoing vigilance is advised, as the underlying hosting provider can be leveraged for other abuse campaigns.