worldlibertifyfinancials[.]com

Analysis of the domain worldlibertifyfinancials.com indicates a high-risk crypto scam impersonating the 1inch decentralized exchange platform. The domain, created on February 21, 2026, resolved to IP address 172.67.156.228, hosted on Cloudflare infrastructure (AS13335). The page title, 'Home | Mainnet Sync app,' aligns with terminology commonly used in crypto wallet or DeFi synchronization tools, suggesting an attempt to deceive users into interacting with malicious smart contract functions or credential harvesting mechanisms. As of the report date, the domain has been taken offline, though it remains flagged by five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

VirusTotal data shows 11 of 93 security vendors marked the domain as malicious, reinforcing its classification as a confirmed threat. The SSL certificate (WE1) provides no additional trust indicators, as it is a low-assurance Cloudflare-issued certificate. No evidence of Safe Browsing or OTX pulses was provided, leaving uncertainty about broader detection coverage.

Defenders should treat this domain as a confirmed brand impersonation vector, particularly for users of 1inch or related DeFi platforms. Network-level blocking is recommended for the domain and its resolved IP, while security teams should monitor for related infrastructure, such as newly registered domains with similar naming patterns or Cloudflare-hosted IPs exhibiting comparable page titles. The domain's offline status does not preclude future reactivation; continuous monitoring of passive DNS and certificate transparency logs is advised.