claim[.]usd1-worldlibertyfinancial[.]pro

This domain is flagged as an elevated-risk airdrop scam, designed to impersonate legitimate financial distribution events. Analysis indicates the site targeted users with fraudulent token or fund claims under the guise of a "World Liberty Financial" airdrop, a tactic commonly used to harvest credentials or cryptocurrency wallet access. The page title explicitly advertised "World Liberty Financial | Airdrop," reinforcing the social engineering lure.

Infrastructure analysis reveals the domain was registered on March 23, 2026, through HOSTINGER operations, UAB, and resolved to IP address 172.67.193.124. Detection metrics show 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appeared on two security blocklists and was proactively blocked by two additional threat intelligence feeds. Technologies detected include jsDelivr, crypto-js, cdnjs, Cloudflare, and HTTP/3, suggesting the use of content delivery networks and encryption libraries to obfuscate malicious activity.

Mitigation steps for this threat type include immediate domain blacklisting in enterprise security gateways and endpoint protection systems. Network administrators should block traffic to 172.67.193.124 and monitor for connections to related subdomains or CDN endpoints. Security teams should conduct retrospective analysis for internal systems that accessed the domain and verify no credentials or wallet interactions occurred. User awareness training should emphasize the risks of airdrop scams, particularly those leveraging urgency or financial incentives to bypass scrutiny.