unlock-worldlbertyfi[.]xyz

The domain unlock-worldlbertyfi.xyz is currently active and engaged in brand impersonation targeting LinkedIn users with the intent to distribute crypto drainer malware. Analysis indicates the site presents itself as a token unlock service for World Liberty Financial (WLFI), a tactic commonly associated with fraudulent cryptocurrency schemes. The domain is operational and poses a high risk to users who may be deceived into interacting with it under false pretenses. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.44.150, hosted on Cloudflare’s network (AS13335). The domain has been flagged by 18 of 95 security vendors on VirusTotal, and it appears on four distinct security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), a common feature observed in both legitimate and malicious domains to evade basic detection mechanisms. The page title, 'World Liberty Financial - Easily unlock your WLFI tokens,' directly references cryptocurrency assets, a red flag for potential crypto drainer activity. The domain remains active and unmitigated at the time of this report. Organizations and users are advised to block the domain and its associated IP address (104.21.44.150) at the network level. Endpoint protection systems should be updated to include this domain in denylists, and security teams should monitor for any attempts to access or interact with it. Users who may have engaged with the site should immediately revoke any connected wallet permissions and scan their systems for malware. Given the domain’s association with crypto drainer tactics, financial institutions and cryptocurrency platforms should issue alerts to their users regarding this threat.