title: DNS Query for LiteLLM 1.107.0 Exfiltration Domain
id: 2b8c4d7e-5f19-4a63-9e01-7c3a6b2d8f14
status: experimental
description: DNS lookup of litellm.dev / www.litellm.dev (lookalike registered 13 Oct 2026, used by the privcollect stealer). Does not match the legitimate litellm.ai.
references:
    - https://docs.litellm.ai/blog/security-incident-oct-21-2026
author: Cybaverse
date: 2026-10-21
tags:
    - attack.exfiltration
    - attack.t1041
logsource:
    category: dns
detection:
    selection:
        query|endswith: 'litellm.dev'
    condition: selection
falsepositives:
    - Researchers or blocklist validation
level: high