worldlibertyrewards[.]net

Analysis of the domain worldlibertyrewards.net indicates active involvement in a fraudulent airdrop scheme, classified under generic phishing with a high-risk designation. Registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335). Nameservers kami.ns.cloudflare.com and matteo.ns.cloudflare.com further confirm Cloudflare's role in its DNS resolution. The domain is currently active, returning an HTTP 403 status, which may suggest restricted access or defensive measures against automated crawlers. Security vendors have flagged this domain, with 9 out of 93 detection engines on VirusTotal identifying it as malicious. It appears on three security blocklists and has been documented in one AlienVault OTX threat intelligence pulse, reinforcing its association with phishing activity. The page title 'Cierpliwości...' provides limited insight into its exact content, though the scam type is explicitly labeled as a fake airdrop, likely targeting cryptocurrency users. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain's malicious intent, as threat actors commonly leverage legitimate certificates to appear trustworthy. Defenders should treat this domain as hostile and prioritize blocking or monitoring any connections to it. The use of Cloudflare infrastructure complicates attribution and takedown efforts, as it obscures the true hosting provider. Given its recent registration and active status, further monitoring is recommended to track potential shifts in its infrastructure or associated campaigns. No additional brand impersonation details are available at this time, and the exact mechanics of the airdrop scam remain unconfirmed.