liminalmoney[.]xyz

PhishDestroy identifies liminalmoney.xyz as a newly active crypto drainer posing as a legitimate financial service. This domain, registered on October 03, 2025, is designed to deceive users into submitting cryptocurrency wallet credentials or transaction approvals under the guise of a financial portal. The infrastructure is hosted on IP 172.67.202.106 and leverages a Google Trust Services SSL certificate to appear trustworthy at first glance. This domain was flagged by 4 out of 95 security vendors on VirusTotal, indicating a heightened but not universal detection rate. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with short-lived or malicious domains. Users interacting with this domain risk unauthorized cryptocurrency transfers, credential theft, or malware installation. If you visited liminalmoney.xyz or entered any information, disconnect from the internet immediately. Review your cryptocurrency wallet and financial accounts for unauthorized transactions. Revoke any approvals granted to unknown domains and run a malware scan on your device. Report the domain to your IT security team or local cybercrime unit to prevent further exploitation.