thortitn[.]info

PhishDestroy identifies thortitn.info as a high-risk crypto drainer specifically designed to impersonate the MetaMask brand. The site lures victims with a fraudulent "$MASK Token Airdrop" promotion, aiming to drain cryptocurrency wallets. This domain was created on April 21, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious domains. It resolves to IP address 188.114.97.3 and uses a Let's Encrypt SSL certificate (E8), which gives it a false sense of legitimacy.

Technical indicators underscore the threat: VirusTotal reports 16 out of 95 security vendors flagging the domain, and it appears on 4 security blocklists. The page title, "MetaMask — $MASK Token Airdrop," is a classic lure for airdrop phishing campaigns. The domain is currently offline, but its infrastructure could be reactivated under a new domain or IP. Users who may have interacted with the site should immediately revoke any token approvals and secure their wallets.

Despite being taken offline, the risk remains for users who previously visited or connected their wallets. PhishDestroy recommends avoiding any unsolicited airdrop offers and verifying all URLs before connecting a wallet. If you have already interacted with thortitn.info, transfer funds to a new wallet and use a revoke tool to remove permissions. Stay vigilant against similar domains targeting MetaMask users.