liquidity-pool2018[.]top

The domain liquidity-pool2018.top has been identified as a high-risk phishing infrastructure specifically targeting cryptocurrency liquidity pool participants. Analysis indicates this is a generic phishing operation designed to harvest credentials and private keys through fraudulent liquidity pool interfaces. The domain is currently offline, though prior activity suggests it may have impersonated decentralized finance platforms to deceive victims. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on March 28, 2026, an unusually future-dated registration that may indicate domain generation algorithm usage or administrative error. It resolved to the IP address 188.114.97.3 and was flagged by 14 of 95 security vendors on VirusTotal. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and InversionDNS. Google Safe Browsing classifies this as SOCIAL_ENGINEERING, while Gridinsoft assigned a trust score of 0/100. AlienVault OTX records the domain in one threat intelligence pulse, confirming its malicious classification. Current status shows the domain has been taken offline, though similar infrastructure may reappear under different names. Organizations are advised to implement DNS-level blocking for this domain and monitor for related indicators of compromise. Users should verify liquidity pool URLs through official project documentation and enable multi-factor authentication for all cryptocurrency accounts. Security teams should investigate any connections to 188.114.97.3 in historical logs and consider adding the domain to internal threat intelligence feeds for retrospective analysis.