woridlibertyfinancial[.]xyz

This domain, woridlibertyfinancial.xyz, is flagged as a confirmed brand impersonation targeting Binance, with an elevated risk classification due to its infrastructure and detection history. Registered on September 13, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain currently resolves to a Cloudflare-hosted IPv6 address (2606:4700:3030::6815:5001) under AS13335, with nameservers eric.ns.cloudflare.com and tricia.ns.cloudflare.com. No SSL certificate was detected, increasing the likelihood of interception or tampering during transmission. The page title, 'World Liberty Financial - Meet USD1,' suggests an attempt to mimic financial services, though the exact content and functionality remain unanalyzed.

Analysis indicates the domain has been taken offline, but prior detections include one security blocklist (PhishDestroy) and eight flags from 95 security vendors on VirusTotal. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. Defenders should treat this domain as compromised infrastructure, particularly given its association with a known cryptocurrency brand.

While the current status is offline, historical resolution data and detection patterns warrant monitoring for reactivation or related domains. No evidence of a phishing kit or additional threat actor infrastructure is available in the provided data. Immediate action includes blocking resolution at the DNS level and reviewing logs for prior connections to the domain or its associated IP.