mainnet-worldlibertyfinancia[.]mirowb3[.]icu

Analysis of mainnet-worldlibertyfinancia.mirowb3.icu indicates a generic phishing domain registered on February 21, 2026, through Web Commerce Communications Ltd. The domain is currently offline, with no active HTTP response or accessible content. Infrastructure review shows it was hosted on Cloudflare IP 104.21.64.1 (AS13335, US) and used nameservers ns100.webnic.cc and ns101.webnic.cc. The SSL certificate is issued by WE1, a common provider for low-cost or automated hosting environments. Detection data is limited: the domain appears on one security blocklist (PhishDestroy), while 93 vendors on VirusTotal reported no flags at the time of scanning.

The absence of detections does not confirm safety, particularly given the domain's recent registration and offline status. The observed page title 'Just a moment...' suggests a Cloudflare challenge or placeholder page, which is consistent with domains taken down or suspended before full deployment. No brand, scam type, or specific phishing kit has been identified in the available evidence. The domain name contains terms like 'mainnet' and 'libertyfinancia,' which may imply a financial or cryptocurrency theme, but no direct brand impersonation is confirmed.

Defenders should treat this domain as potentially malicious based on its registration context, hosting provider, and single blocklist flag. Monitoring for reactivation or related infrastructure (e.g., nameservers, registrar, or ASN reuse) is recommended. If encountered in logs or proxy data, the domain should be blocked pending further analysis.