worldlibertyflinancial[.]com

Analysis of worldlibertyflinancial.com shows a newly registered domain created on 24 November 2025 that is currently taken offline. The domain resolves to IP address 46.202.198.36, which is assigned to AS47583 Hostinger International Limited and geolocated to the United States. Registration was performed through HOSTINGER operations, UAB, and the domain appears on a single security blocklist. VirusTotal reports three detections out of ninety‑three scanners, indicating limited but non‑trivial activity.

The site presents a generic "Default page" title and carries an SSL certificate identified as R12, suggesting a standard, possibly self‑signed or low‑validation certificate. Gridinsoft assigns a trust score of 46 out of 100, reflecting a moderate risk posture. The threat classification is listed as Brand Impersonation targeting WordPress, aligning with the supplied brand target field. PhishDestroy has already blocked the domain, and the risk level is marked as elevated.

While the offline status limits immediate exposure, the infrastructure details—hosted on a shared Hostinger server, low trust score, and partial detection by security vendors—indicate that the domain was likely used to mimic WordPress‑related services in a credential‑harvesting campaign. Defenders should continue to monitor the IP range for related activity, enforce blocklists that include this domain, and consider tightening email and web filtering rules for any communications referencing WordPress login or support URLs that could be associated with this infrastructure. Further investigation of any residual traffic or DNS queries to the IP may reveal additional malicious artifacts or related campaigns.