cp[.]worldlibertyfinancialchain[.]com

The domain cp.worldlibertyfinancialchain.com has been identified as a phishing site specifically designed to impersonate the CloudPanel login interface. Analysis indicates this is a case of brand impersonation, where attackers replicate the legitimate CloudPanel authentication portal to harvest credentials from unsuspecting users. As of the latest verification, the domain has been taken offline, though prior activity suggests it was actively targeting system administrators or hosting clients familiar with CloudPanel’s interface. Infrastructure analysis reveals the domain was registered on November 12, 2025, through GoDaddy.com, LLC, a widely used registrar. It resolved to the IP address 194.163.163.123 and was detected by 2 of 95 security vendors on VirusTotal, indicating limited but confirmed malicious classification. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, reinforcing its high-risk designation. Technical indicators include the use of Bootstrap, Nginx, and jQuery, alongside an SSL certificate labeled 'TRAEFIK DEFAULT CERT,' which is often associated with misconfigured or malicious hosting environments. The page title 'CloudPanel | Log In' further confirms the intent to deceive users into believing they are accessing a legitimate control panel. While the domain is currently offline, the infrastructure and techniques observed align with broader phishing campaigns targeting web administrators. Organizations and individuals are advised to verify the authenticity of login portals by cross-referencing domain registration details, SSL certificates, and page titles before entering credentials. System administrators should monitor for unauthorized access attempts and enforce multi-factor authentication on critical accounts. Users who may have interacted with this domain should rotate credentials immediately and review connected systems for signs of compromise. Proactive monitoring of newly registered domains with similar naming patterns (e.g., 'libertyfinancialchain') is recommended to mitigate future risks.