wifl-unlock[.]icu

The domain wifl-unlock.icu was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on September 5 2025. It resolves to the Cloudflare address 104.21.96.15, which is announced by AS13335 (Cloudflare, Inc.) and is geolocated to the United States. The site presented the page title “World Liberty Financial – Inspired by Trump, Powered by USD1” and was identified as a crypto‑scam that impersonates the Binance brand. VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain as malicious. Independent blocklist feeds list the domain on two reputable sources: PhishDestroy and ScamSniffer. The Gridinsoft trust score is 0 out of 100, indicating a lack of trustworthiness.

The SSL certificate is identified as “WE1”, suggesting a self‑signed or otherwise weak certificate. As of the report date the host has been taken offline, and the domain is currently inactive. Evidence confirms that the infrastructure is typical of CDN‑based phishing operations, using Cloudflare to hide the true origin. The combination of a low trust score, multiple vendor detections, and placement on dedicated anti‑phishing lists provides strong confidence that the site was used for fraudulent activity targeting Binance users. However, the exact content of the page, any credential‑capture mechanisms, and the presence of additional payloads remain unknown because the site is no longer reachable.

Defenders should immediately add wifl-unlock.icu to network denial lists and block the resolved IP address 104.21.96.15 at the perimeter. Email security gateways should be updated to flag any messages referencing the Binance brand that contain links to this domain. Threat‑intel platforms should be refreshed with the observed indicators, including the registrar, creation date, SSL fingerprint, and the two blocklist identifiers. Continuous monitoring of the underlying Cloudflare IP range is advised, as the operators may redeploy the scam under a new domain using the same hosting provider.