worldliberty-financi[.]com

The domain worldliberty-financi.com is currently flagged as an active brand impersonation site targeting Chainlink, a prominent decentralized finance (DeFi) protocol. Analysis indicates this infrastructure is designed to mislead users by presenting itself as a legitimate financial platform, specifically under the guise of 'World Liberty Financial - Where DeFi Meets TradFi.' The threat type is classified as brand impersonation, with the intent likely focused on credential theft or crypto asset compromise, given the context of the targeted brand and page content. Infrastructure analysis reveals the domain was registered on February 21, 2024, through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.138.51, hosted on Cloudflare's network (AS13335) in the United States. The domain is flagged by 17 of 95 security vendors on VirusTotal, with additional detections across four distinct security blocklists. Protective measures have been implemented by multiple threat intelligence platforms, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Google Trust Services under the identifier WE1, a common characteristic of both legitimate and malicious sites leveraging Cloudflare services. Current status remains active, with no indications of takedown or mitigation at the time of analysis. Users are strongly advised to avoid interaction with this domain and any associated links. Organizations are recommended to update their security controls to block the domain and its resolving IP address. Given the high-risk nature of this threat, particularly in the context of DeFi and crypto asset management, affected entities should monitor for unauthorized access attempts and consider proactive credential rotation for any accounts potentially exposed to this campaign.