worldlibertyfinancial-claim[.]xyz

Analysis of worldlibertyfinancial-claim.xyz shows the domain was registered on September 1 2025 through Unstoppable Domains Inc. and is currently taken offline. DNS resolution points to the IPv4 address 92.246.141.126, which resolves to a host located in Germany. The authoritative name servers are ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, and ns-cloud-d3.googledomains.com. The site presented the page title “wlfi‑foundation — Claim is live,” indicating a claim‑related landing page.

VirusTotal records 15 of 93 scanning engines flagging the domain, and the domain is listed on at least one public security blocklist. PhishDestroy has explicitly blocked the host. The SSL certificate is identified as “R12,” and the observed scam type is a “Fake Airdrop,” targeting users of the brand “across.” The domain’s risk level is elevated, and the impersonation of across suggests a credential‑harvesting or token‑distribution lure.

Evidence confirms the infrastructure, but the exact content of the landing page and any payloads remain unknown because the site is offline. Defenders should add the IP address 92.246.141.126 and the domain name to network‑level deny lists, monitor for DNS queries to the listed Google Cloud name servers, and ensure that any across‑related authentication flows are protected by multi‑factor authentication and anomaly detection. Continuous re‑scanning with VirusTotal or similar services is advised to capture any future changes, and security teams should share the indicator set with threat‑intel sharing platforms to improve community awareness.