wlfinfo[.]net

Analysis of the domain wlfinfo.net indicates it was actively impersonating Binance as part of a cryptocurrency scam. The domain, registered on August 19, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolved to the IP address 172.67.168.31, hosted on Cloudflare's infrastructure (AS13335) in the United States. The page title, 'World Liberty Financial - Inspired by Trump, Powered by USD1,' suggests an attempt to leverage political branding alongside financial themes, though the exact content and functionality of the site remain unconfirmed as the domain is currently offline. Security vendors have flagged wlfinfo.net with varying levels of detection.

As of the latest available data, six out of 93 security vendors on VirusTotal classified the domain as malicious. Additionally, the domain appears on two security blocklists and has been blocked by PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of 0/100, further indicating high risk. The SSL certificate was issued by WE1, a provider commonly used by both legitimate and malicious sites, offering no definitive signal on its own.

While the domain is now offline, defenders should treat any residual links or cached versions as high-risk. Organizations monitoring for brand impersonation, particularly targeting Binance or cryptocurrency users, should include wlfinfo.net in their threat intelligence feeds. Given the domain's registration date and the use of Cloudflare, which is frequently employed to obscure hosting details, further investigation into related infrastructure may be warranted. No evidence of a phishing kit or specific scam mechanics (e.g., crypto drainer, fake exchange) is present in the available data, so classification remains limited to brand impersonation and cryptocurrency scam activity.