worldlibertyflnacials[.]xyz

Analysis indicates that the domain worldlibertyflnacials.xyz was registered on 24 August 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 188.114.96.3 located in the United States. The domain resolves to Cloudflare name‑servers algin.ns.cloudflare.com and brianna.ns.cloudflare.com. No TLS certificate is presented, meaning the site is served over plain HTTP only. The page title returned by the HTTP response is “Nur einen Moment…”, which does not provide any indication of legitimate content and is commonly used by fraudulent pages to delay user interaction. The domain is currently listed as offline and has been taken down, but it remains recorded on at least one security blocklist.

Detection services have flagged the domain: six of ninety‑five VirusTotal scanners reported malicious activity, and Gridinsoft assigned a trust score of zero out of one hundred, indicating a high confidence of abuse. PhishDestroy has also added the domain to its blocklist, confirming its classification as a phishing resource. Because the domain resolves to a Cloudflare‑provided IP, attribution to a specific operator is limited, and the underlying hosting provider may be unaware of the misuse. The lack of an SSL certificate further reduces the credibility of any service that might have been hosted there.

No additional intelligence such as malware hashes, command‑and‑control endpoints, or observed payloads is available in the current data set. Defenders should continue to block the domain at perimeter filters and DNS resolvers, monitor for any re‑appearance on the same IP address or name‑server pair, and treat any inbound traffic claiming to originate from worldlibertyflnacials.xyz as malicious. Organizations using threat‑intelligence feeds should ensure that the domain indicator is propagated to all endpoint protection platforms, web gateways, and email security solutions.