liwo[.]fi

This domain, liwo.fi, poses a high risk of brand impersonation, specifically targeting Google. Users who navigate to this site may be tricked into believing they are interacting with a legitimate Google service, potentially leading to the compromise of sensitive information such as login credentials or financial data.

Analysis indicates that liwo.fi has been flagged by 13 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion within the security community. The domain was created on May 26, 2026, and is registered through Key-Systems GmbH. It resolves to the IP address 142.251.153.119, which is known to be associated with Google Web Server infrastructure. Additionally, the site employs HSTS and HTTP/3, which can mask its malicious intent by appearing more secure.

If a user has visited liwo.fi, it is crucial to take immediate action to protect personal data. This includes changing passwords for Google accounts and any other accounts that use similar credentials. Users should also monitor their accounts for any unusual activity and consider enabling two-factor authentication (2FA) for an added layer of security. Reporting the incident to the relevant security authorities is recommended to help mitigate the impact of this threat.