worldliberty-financial[.]netlify[.]app

Analysis of worldliberty-financial.netlify.app confirms brand impersonation targeting World Liberty Financial, classified as elevated risk. The domain was hosted on Netlify infrastructure and resolved to 35.157.26.135, an Amazon.com, Inc. address in Germany (AS16509). As of July 25, 2026, the site returns an HTTP 404 status, indicating it has been taken offline. The page title 'World Liberty' aligns with the impersonated brand, though no further content analysis is available to confirm specific fraud mechanisms.

The domain appears on one security blocklist, specifically PhishDestroy, and was flagged by 11 of 95 security vendors in a VirusTotal scan. SSL certification was issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, a standard but not inherently suspicious provider. Technologies detected include Netlify hosting and HSTS enforcement, which do not indicate malicious activity alone but are consistent with phishing infrastructure. No nameserver details or additional registration data were provided.

The absence of further blocklist or threat intelligence platform alerts does not reduce risk, as brand impersonation domains often evade detection until active abuse is reported. Defenders should treat this domain as compromised and maintain blocking rules even after takedown, as threat actors frequently re-deploy similar infrastructure. If World Liberty Financial is a protected brand, monitoring for newly registered lookalike domains on Netlify or other hosting platforms is recommended.