worldliebertyfinancial[.]xyz

The domain worldliebertyfinancial.xyz was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP 142.250.65.196, which belongs to AS15169 owned by Google LLC and is located in Mexico. The hosting infrastructure therefore leverages Google’s network, a common choice for malicious actors seeking legitimate‑looking IP reputation. The site presented a page title of "Google", matching the declared brand target, and is classified as credential phishing. The SSL certificate is identified as "WR2", indicating a standard TLS certificate without extended validation.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of confidence in the domain’s legitimacy. VirusTotal scans returned seven detections out of ninety‑five vendors, confirming that multiple security products flag the domain as malicious. The domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer, and is currently marked offline. Nameservers are hosted on Cloudflare (kianchau.ns.cloudflare.com, margot.ns.cloudflare.com), which is typical for fast‑flux or fast‑re‑deployment tactics.

The page title and brand target suggest an attempt to lure Google users into providing credentials, but the actual page content has not been captured, leaving the exact phishing vector uncertain. Defenders should block the domain at DNS and proxy layers, add the IP 142.250.65.196 to deny‑list rules, and monitor for any new subdomains under the same registrar or nameserver set. Continuous re‑scanning of the domain via multi‑vendor services is advised, as the detection count may evolve. Incident response teams should also correlate any credential‑theft alerts with this indicator of compromise to identify potential compromised accounts.