app-liquidbsc[.]com

Analysis of app-liquidbsc.com, observed on July 24 2026, shows a high‑risk generic phishing indicator. The domain was registered through NiceNIC International Group Co., Limited and first seen on 21 February 2026. HTTP requests return a 301 redirect, and the site is served behind Cloudflare (nameservers rudy.ns.cloudflare.com and ryleigh.ns.cloudflare.com) with the origin IP 188.114.97.3 located in the United States under ASN 13335. The TLS certificate is issued by Google Trust Services (WE1), confirming a valid HTTPS endpoint.

Page metadata reports the title “LiquidBNB,” suggesting an attempt to lure victims with a cryptocurrency‑related name. Technical fingerprinting reveals AngularJS, Smartsupp, jQuery (including CDN delivery), and HTTP/3 support, all typical of modern web‑based phishing kits. Reputation data is unfavorable: Gridinsoft assigns a trust score of 0 / 100, the domain appears on one security blocklist, and PhishDestroy has already blocked it. VirusTotal analysis records eight of ninety‑three scanning engines flagging the host, and AlienVault OTX lists the domain in a single threat‑intel pulse.

The combination of a fresh registration, low trust score, multiple vendor detections, and active blocklist entries indicates that the domain is being used for malicious credential harvesting. No public evidence clarifies the exact phishing landing page or victim interaction flow, so the full scope of the campaign remains uncertain. Defenders should add app‑liquidbsc.com to URL filtering and endpoint allow‑list exclusions, enforce TLS inspection to capture any credential submissions, and monitor network traffic for connections to 188.114.97.3. Continuous feed updates from VirusTotal, OTX, and blocklist providers should be consulted for any new detections, and any observed malicious activity should be reported to the respective sinkholes.