worldlibertytoken[.]finance

worldlibertytoken.finance is an active brand‑impersonation site targeting users of the OKX platform. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and carries a Gridinsoft trust score of 0 / 100, indicating a lack of legitimacy. It is currently listed on one security blocklist and has been blocked by PhishDestroy. The page title returned by the server is “Nur einen Moment…”, and the site is classified as a cryptocurrency scam. Infrastructure analysis shows the domain resolves to IP 104.21.96.1, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. The service uses Cloudflare’s CDN, presents HTTP/3 support, and serves a TLS certificate issued by SSL Corporation / Cloudflare TLS Issuing ECC CA 3. Nameservers eoin.ns.cloudflare.com and mina.ns.cloudflare.com confirm the reliance on Cloudflare’s DNS infrastructure. Detection metrics reveal that three of ninety‑five VirusTotal scanners have flagged the domain, reinforcing the suspicion raised by the zero‑score Gridinsoft rating. The HTTP response code observed is 403, suggesting intentional access restriction or a deterrence mechanism. Beyond the title, the actual page content has not been captured, leaving the precise phishing vector and any credential‑harvesting forms unverified. Defenders should treat the domain as high‑risk and enforce blocklisting at network perimeter and DNS filtering layers. Continuous monitoring of the associated IP range and Cloudflare‑served domains is advised, as the infrastructure can be reused for future impersonation campaigns. Incident response teams should also incorporate the registrar and name‑server details into threat‑intel feeds to aid correlation with similar campaigns.