lhghter[.]xyz

This domain, lhghter.xyz, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure was specifically designed to mimic legitimate authentication portals, capturing sensitive credentials such as usernames, passwords, and multi-factor authentication tokens. The domain exhibits characteristics consistent with large-scale phishing campaigns, including the use of cloud-hosted infrastructure and rapid deployment tactics to evade detection. Infrastructure analysis reveals lhghter.xyz was registered on March 28, 2026, through Dynadot LLC, a registrar frequently observed in malicious domain registrations. The domain resolves to the IP address 54.215.31.113, a cloud-hosted endpoint with a history of association with phishing activity. At the time of assessment, the domain was flagged by 5 out of 95 security vendors on VirusTotal and appeared on one security blocklist. Additionally, it was included in one threat intelligence pulse on a public threat intelligence platform, further corroborating its malicious nature. Users who accessed lhghter.xyz or entered credentials on any site associated with this domain should immediately reset passwords for all accounts where the same credentials may have been reused. Enable multi-factor authentication on critical accounts to mitigate the risk of unauthorized access. Monitor financial and communication platforms for signs of compromise, such as unauthorized transactions or messages. Network administrators are advised to block the domain and its resolving IP address (54.215.31.113) at the perimeter to prevent further exposure within their environments.