limitedless[.]exchange

This domain, limitedless.exchange, presents a high-risk brand impersonation threat specifically targeting users of the MetaMask cryptocurrency wallet service. Analysis indicates the site mimics legitimate MetaMask interfaces under the false pretense of a "Limitless Exchange," likely designed to harvest wallet credentials, recovery phrases, or other sensitive authentication details. The infrastructure appears engineered to deceive users into believing they are interacting with an official MetaMask platform, thereby facilitating unauthorized access to digital assets. Evidence supporting this assessment includes multiple technical indicators. The domain is flagged by 12 out of 95 security vendors on VirusTotal, and it appears on three distinct security blocklists. Registered through NiceNIC International Group Co., Limited on February 21, 2026, the domain resolves to the IP address 104.21.25.54 and is currently offline. The SSL certificate is issued by Google Trust Services, while technologies such as HSTS, Cloudflare, and HTTP/3 are detected, suggesting an attempt to appear legitimate and secure. Additionally, the domain holds a Gridinsoft trust score of 0/100, further confirming its malicious nature. Users who have visited limitedless.exchange should take immediate action to mitigate potential risks. If any credentials, recovery phrases, or personal information were entered on the site, affected accounts should be considered compromised. Users are advised to revoke any connected sessions, transfer assets to a new secure wallet, and monitor for unauthorized transactions. Enabling multi-factor authentication on all related accounts and reporting the incident to relevant security teams or financial institutions is strongly recommended. Vigilance against similar threats should be maintained, particularly when interacting with cryptocurrency-related platforms.