worldliberty-finances[.]com

The domain worldliberty-finances.com was registered on February 21, 2026 through Ultahost, Inc. and resolves to the IPv4 address 159.100.6.5, which is assigned to AS214036 in Germany and hosted by the same provider. The site returns HTTP 200 over a LiteSpeed web server that also supports HTTP/3, and presents a valid Let’s Encrypt certificate (R12). Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent.

Independent analysis on VirusTotal shows that 12 of 95 scanning engines flag the domain, indicating a consensus of detection across multiple vendors. The domain appears on three external security blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as an active threat. Nameserver delegation uses four Ultahost‑controlled name servers (ns1‑ns4.ultahost.com), which aligns with the registrar information and further confirms the hosting relationship.

While the specific brand or service being spoofed has not been disclosed in the available intelligence, the combination of a recent registration, low trust score, multi‑engine detections, and active blocklist entries points to a generic phishing operation targeting financial credentials. Defensive teams should add 159.100.6.5 to network deny lists, monitor DNS queries for the listed Ultahost name servers, enforce HTTPS inspection to capture any credential‑submission attempts, and ensure that endpoint web‑filtering solutions block the domain based on its identified signatures. Continuous re‑evaluation is advised, as additional indicators such as page content or credential‑harvesting tactics may emerge with further probing.