wlfi-defi[.]top

This domain is flagged as a high-risk brand impersonation threat specifically targeting Gmail users. Analysis indicates the site mimics legitimate login portals to harvest credentials, a tactic commonly associated with phishing campaigns designed to compromise user accounts and facilitate unauthorized access to sensitive information. The domain employs deceptive branding elements, including the page title 'World Liberty Financial,' to lend an appearance of legitimacy while executing credential theft operations. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain wlfi-defi.top resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335) in the United States. It was registered on October 22, 2025, through Dynadot LLC, a registrar frequently utilized in phishing operations. Security vendors on VirusTotal flag the domain at a rate of 13/95, while Google Safe Browsing explicitly classifies it as a phishing site. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility and short validation period. Mitigation steps for this brand impersonation threat include immediate blocking of the domain at the network level, particularly for organizations with Gmail integrations. Users should be educated to recognize phishing indicators, such as mismatched URLs, unexpected login prompts, and domains registered within the past 30 days. Security teams are advised to monitor for credential reuse attempts stemming from this campaign, as harvested credentials may be leveraged in follow-on attacks. Additionally, domain registrars should be notified of the abusive registration to facilitate takedown procedures, and DNS sinkholing can be employed to disrupt communication with the malicious infrastructure.