worldlibertyfinancialchain[.]com

The domain worldlibertyfinancialchain.com was registered on November 12, 2025 through GoDaddy.com, LLC and is currently offline, returning an HTTP 404 status. DNS resolution points to IP address 194.163.163.123, which belongs to Contabo GmbH (AS51167) in France. The hosting infrastructure serves content over Nginx and announces support for HTTP/3, while the web stack includes Node.js, React, Next.js, and Webpack, indicating a modern JavaScript‑based site that may have been used for credential harvesting. The site presented the page title "World Liberty Financial Chain", which does not directly reference the impersonated brand, yet intelligence tags the domain as a brand impersonation targeting Telegram.

VirusTotal scans flagged the domain by 15 of 95 security vendors, and the domain appears on a single security blocklist. PhishDestroy has also blocked the domain, and AlienVault OTX lists it in one threat‑intel pulse. Reputation services assign a Gridinsoft trust score of 0 out of 100, reflecting a high likelihood of malicious intent. The SSL certificate is issued by Let’s Encrypt (R12), a free certificate authority, which is commonly used by threat actors to quickly obtain HTTPS.

Nameservers ns65.domaincontrol.com and ns66.domaincontrol.com are standard GoDaddy name servers, offering no additional mitigation. While the domain is currently offline, the observed infrastructure—French hosting, modern web stack, low trust score, and multiple vendor detections—suggests it was part of a Telegram impersonation campaign. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same IP or hosting provider, and add the associated IP and certificate fingerprint to internal blocklists. Threat intelligence feeds should be updated to include the domain, its IP, and the observed technology stack to aid in correlation with future campaigns.