liquid-loans[.]com

PhishDestroy identifies liquid-loans.com as a recently activated crypto drainer domain designed to mimic the legitimate Liquid Loans platform. The domain leverages a fraudulent interface to deceive users into connecting their cryptocurrency wallets, initiating unauthorized token approvals and transfers. No specific drainer kit artifacts (e.g., wallet approval signatures or obfuscated JavaScript payloads) are publicly documented at this stage, but the operational pattern aligns with known crypto-scamming infrastructure targeting DeFi users. The domain exhibits no overt malicious signatures, suggesting a newly deployed or minimally detected threat actor toolkit. This domain was flagged with unique seed e87fbe and resolves to IP 63.176.8.218, hosted on infrastructure associated with low-reputation hosting providers. It was registered through Dynadot Inc on February 25, 2026, only days prior to detection, indicating a high-risk, short-lived campaign. VirusTotal currently reports 2/95 detections across major antivirus engines, demonstrating a critical detection gap. The domain holds a valid SSL certificate issued by Let's Encrypt, enhancing its authenticity. Google Safe Browsing (GSB) has not yet flagged the domain, and no public blocklist entries (e.g., PhishTank, OpenPhish) are recorded. The combination of recent registration, clean VT score, and lack of GSB coverage places this domain in a high-risk window where user exposure is imminent. The threat remains active as of forensic capture, with no takedown or mitigation actions confirmed. Immediate action is required to block access to liquid-loans.com and its resolving IP (63.176.8.218) at network and endpoint levels. Users are advised to avoid interacting with any Liquid Loans-related links outside of the official domain (liquidloans.io) and verify all URLs via official communication channels. Organizations should update firewall rules, DNS blocklists, and email filtering policies to include this domain and IP. Remaining risk includes potential for rapid proliferation, phishing email dissemination, and wallet compromise. Continuous monitoring is essential due to the absence of AV detections and the domain's youthful age.