liarnliarnglobal[.]com

The domain liarnliarnglobal.com is currently active and flagged as a credential theft phishing operation. Analysis indicates the site is designed to harvest user login credentials, financial details, or other sensitive information under the guise of a trusted partner. No specific brand impersonation has been confirmed, but the generic messaging and infrastructure align with broad-scale credential harvesting campaigns targeting corporate or individual users. Infrastructure analysis reveals the domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 158.94.210.56, which has been linked to multiple phishing campaigns in recent threat intelligence reports. As of the latest scan, 3 of 95 security vendors on VirusTotal have flagged the domain as malicious, with detection rates likely to increase as additional telemetry is collected. The page title, "liarnliarnglobal – liarnliarnglobal – Your trusted partner," employs social engineering tactics to establish false credibility with potential victims. Current status confirms the domain remains active and operational, with no indications of takedown or mitigation efforts. Organizations and individuals are advised to block the domain and its associated IP address (158.94.210.56) at the network perimeter. Endpoint protection solutions should be updated to include this domain in deny lists, and users should be educated on recognizing credential theft tactics, such as unsolicited login prompts or requests for sensitive information. Monitoring for related domains registered under the same registrar or resolving to the same IP range is recommended to preemptively disrupt additional infrastructure.