wolrdlibertyfinacial[.]xyz

This domain is flagged as a high-risk active phishing threat. Registered on August 25, 2025, through NiceNIC International Group Co., Limited, it resolves to IP address 104.21.20.228. The page title is 'Just a moment...', which is commonly used by Cloudflare challenge pages before redirecting to the actual content. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, with an SSL certificate issued by Google Trust Services. VirusTotal reports 10 of 95 security vendors flagging this domain as malicious, and it appears on two security blocklists, including PhishDestroy and BLP-Malware. AlienVault OTX indicates the domain is present in 23 threat intelligence pulses, suggesting widespread recognition as a threat. The exact nature of the phishing content is not yet analysed, as the page title alone does not reveal a specific brand or scam type. Defenders should block this domain at network and email gateways, monitor for any related subdomains or IP changes, and review logs for any connections made to it. Given the high vendor detection rate and inclusion in multiple threat feeds, immediate action is recommended.