litv1[.]info

This domain, litv1.info, is flagged for brand impersonation, specifically targeting MetaMask. The domain was used to create a deceptive web page that mimics the legitimate MetaMask interface, potentially tricking users into divulging sensitive information such as login credentials and private keys. The threat leverages the impersonation of trusted brands to exploit user trust and gain unauthorized access to accounts.

Analysis indicates that the domain litv1.info has received 0/95 detections on VirusTotal, suggesting that it has not yet been flagged by major antivirus and security services. The domain was registered through NiceNIC International Group Co., Limited on February 21, 2026. Infrastructure analysis reveals that the domain resolves to the IP address 188.114.96.3 and uses technologies such as jsDelivr, HSTS, crypto-js, cdnjs, Cloudflare Browser Insights, Cloudflare, and HTTP/3. Additionally, the domain appears on four security blocklists and has been taken offline. The SSL certificate is issued by Google Trust Services, which may have contributed to a false sense of security among users.

If users have visited litv1.info, they are advised to immediately change their MetaMask login credentials and private keys. It is also recommended to monitor account activity for any unauthorized transactions or suspicious behavior. Users should report the incident to their respective security teams and consider enabling two-factor authentication for enhanced protection. To prevent future exposure to similar threats, users should verify the URL of websites they visit and be cautious of unsolicited links or requests for sensitive information.