woridiibertyflnance[.]icu

This domain, woridiibertyflnance.icu, was registered by Web Commerce Communications Ltd on 2025-06-11 and currently resolves to IP 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. The site is presently offline, and active monitoring indicates that it is listed on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal reports that seven of ninety-three scanning engines have flagged the domain, reinforcing its malicious reputation. The SSL certificate presented as "WE1" suggests an improperly issued or self-signed certificate, a pattern frequently observed in fraudulent crypto-related portals.

Gridinsoft assigns a trust score of 0 / 100, confirming the lack of legitimacy. The page title observed, "$WLFI Airdrop | Official Checker," together with the declared brand target "metamask" and the classification "Crypto Scam," indicates the use of an airdrop-themed phishing kit designed to lure MetaMask users into disclosing private keys or signing malicious transactions. No additional page content has been captured, so the full login flow and data-exfiltration mechanisms remain unverified. Defenders should continue to block woridiibertyflnance.icu at DNS resolvers, firewalls, and email gateways, and should add the associated IP 188.114.97.3 to deny-list rules, particularly for any outbound connections to unfamiliar TLS endpoints.

Monitoring for re-hosting of the same domain or replication of the $WLFI airdrop page under similar naming conventions is advised. Given the low trust score and multiple vendor detections, threat-hunting queries that filter for recent domain creations linked to the Cloudflare ASN, combined with MetaMask-related keywords, will help surface related campaigns early. Analysts should also review any recent phishing emails referencing MetaMask airdrops that reference the $WLFI token, as they may be leveraging the same social engineering narrative.