# liminalmoney.xyz — SUSPICIOUS

> liminalmoney.xyz is a crypto drainer impersonating a financial portal. VirusTotal flags 4/95 security vendors.

## Summary
PhishDestroy identifies liminalmoney.xyz as a newly active crypto drainer posing as a legitimate financial service. This domain, registered on October 03, 2025, is designed to deceive users into submitting cryptocurrency wallet credentials or transaction approvals under the guise of a financial portal. The infrastructure is hosted on IP 172.67.202.106 and leverages a Google Trust Services SSL certificate to appear trustworthy at first glance.  This domain was flagged by 4 out of 95 security vendors on VirusTotal, indicating a heightened but not universal detection rate. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with short-lived or malicious domains. Users interacting with this domain risk unauthorized cryptocurrency transfers, credential theft, or malware installation.  If you visited liminalmoney.xyz or entered any information, disconnect from the internet immediately. Review your cryptocurrency wallet and financial accounts for unauthorized transactions. Revoke any approvals granted to unknown domains and run a malware scan on your device. Report the domain to your IT security team or local cybercrime unit to prevent further exploitation.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-10-03 21:40:06
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.202.106

## Detection Status
- VirusTotal: 4 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/71609e67-edad-4798-891b-77d7ac2cf122
- PhishDestroy: https://phishdestroy.io/domain/liminalmoney.xyz/
- LLM endpoint: https://phishdestroy.io/domain/liminalmoney.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/liminalmoney.xyz/
Last updated: 2026-03-27