gliquid[.]io

On 12 July 2026, gliquid.io was identified as an active brand‑impersonation campaign targeting Facebook. The site presents a page title of “Google”, a mismatch that suggests an attempt to confuse users and exploit the trust associated with both brands. The domain was registered on 21 February 2026 through Dynadot LLC and is hosted on the IP address 216.58.206.68, which resolves to a Google LLC network (AS15169) located in Germany. The presence of a valid Let’s Encrypt certificate (R13) and support for HTTP/3 indicate a modern web stack, while the inclusion of reCAPTCHA further attempts to appear legitimate.

The authoritative nameservers for gliquid.io are ns1.dyna‑ns.net and ns2.dyna‑ns.net, typical of dynamic DNS services often leveraged for fast‑flux or disposable hosting. The domain currently returns an HTTP 301 redirect, a behavior commonly used to funnel victims to a final malicious payload. Threat intelligence sources have recorded the domain in a single AlienVault OTX pulse and three external blocklists. VirusTotal analysis shows that three of ninety‑five scanners flagged the domain, reinforcing the suspicion of malicious activity.

Given the high risk rating, the zero score from Gridinsoft (0/100) and the fact that the domain is already blocked by PhishDestroy, MetaMask and SEAL, defenders should prioritize immediate containment. Recommended actions include adding gliquid.io to DNS and web‑filter deny lists, monitoring for any sub‑domains that resolve to the same IP, and correlating login attempts to Facebook services that originate from this address space. Continuous observation of the associated nameserver infrastructure is advised, as attackers may pivot to newly registered domains using the same registrar or hosting provider.