liquidityventure[.]org

This domain is flagged as an elevated-risk brand impersonation threat targeting Across, a decentralized cross-chain protocol. The site presents itself as a legitimate forex trading platform under the name "Liquidity Venture," but infrastructure analysis confirms it is a fraudulent operation designed to deceive users into disclosing credentials or transferring assets. The specific threat type involves impersonation of a trusted blockchain brand to exploit user trust in cross-chain services. Analysis indicates the domain liquidityventure.org was registered on March 31, 2025, through Dynadot LLC, a registrar frequently abused for malicious registrations. It resolves to the IP address 198.23.190.194, which has been associated with prior phishing campaigns. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and was actively blocked by PhishDestroy. Detected technologies include UIKit, LiteSpeed, JivoChat, and HTTP/3, suggesting a professionally constructed facade to mimic legitimate financial platforms. The page title, "Liquidity Venture| Home of secure forex trading," further reinforces the deception by falsely claiming security and legitimacy. Mitigation for this brand impersonation threat involves immediate domain blocking at the network and endpoint levels. Organizations should update web filtering rules to deny access to liquidityventure.org and its associated IP 198.23.190.194. Users who may have interacted with the site should revoke any active sessions tied to Across or related services, rotate credentials, and monitor accounts for unauthorized transactions. Security teams are advised to conduct retroactive log analysis for connections to the domain or IP, particularly within the timeframe of March 31, 2025, onward. Given the domain's current offline status, continuous monitoring for re-registration or similar impersonation domains is recommended, as threat actors often re-establish infrastructure under new names.