tryliquid[.]xyz

This domain, tryliquid.xyz, is currently active in a credential theft campaign targeting users of the Liquid cryptocurrency exchange platform. Analysis indicates the site employs brand impersonation techniques, replicating the legitimate exchange's interface and marketing claims, including the tagline 'Trade Like The 1%.' The threat actor's objective appears to be the unauthorized acquisition of user login credentials, which could facilitate subsequent account takeovers and financial theft. Infrastructure analysis reveals the domain was registered on March 17, 2025, through Cloudflare, Inc., and resolves to the IP address 216.150.1.1. Detection metrics show the domain is flagged by 4 of 95 security vendors on VirusTotal, while appearing on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains. The domain's creation date suggests recent deployment, aligning with observed patterns of short-lived phishing infrastructure. Current status remains active, with no evidence of takedown or mitigation at the time of analysis. Organizations and individuals are advised to implement immediate blocking of the domain and associated IP address. Network administrators should monitor for connections to 216.150.1.1 and inspect SSL certificates for Let's Encrypt R12 issuances linked to newly registered domains. Users should verify domain authenticity before entering credentials, particularly when accessing cryptocurrency platforms, and enable multi-factor authentication where available to mitigate credential theft risks.