litnft[.]top

This domain is flagged as a high-risk brand impersonation threat targeting Trust Wallet users through a fraudulent reward portal. Analysis indicates the site operates as a crypto drainer, designed to deceive victims into connecting wallets under the guise of distributing rewards, ultimately siphoning digital assets. The page title, 'REWARD Portal v2 - Latest Web3 Wallets,' reinforces the deception by mimicking legitimate promotional campaigns associated with cryptocurrency platforms.

Infrastructure analysis reveals the domain litnft.top was registered on September 28, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 209.94.90.1, hosted under AS40680 (Protocol Labs) in the United States. The domain lacks an SSL certificate, increasing exposure to man-in-the-middle interception. Detection metrics show 4 out of 95 security vendors on VirusTotal flag the domain as malicious, while PhishDestroy has explicitly blocked it. Only one security blocklist currently lists the domain, suggesting early-stage detection or evasion tactics.

Mitigation requires immediate action from both end-users and security teams. Users should avoid interacting with litnft.top or any unsolicited reward portals, particularly those requesting wallet connections or private key disclosures. Organizations should update web filters to block the domain and its associated IP, while monitoring for similar impersonation patterns targeting cryptocurrency brands. Given the domain's recent registration and low blocklist prevalence, heightened vigilance is advised for related phishing campaigns leveraging comparable infrastructure or social engineering tactics.