light-promax[.]net

This domain is flagged as a high‑risk credential‑phishing site. The domain light‑promax.net was registered on 21 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted behind Cloudflare, resolving to 104.26.1.238, an IP located in Canada. The TLS certificate is issued by Google Trust Services under the WE1 root, and the HTTP response returns status 200. The page title reported is “Light VPN — Личный кабинет”, indicating a potential attempt to harvest VPN service credentials, though the page content has not been analysed. Cloudflare’s DNS service provides the authoritative nameservers betty.ns.cloudflare.com and craig.ns.cloudflare.com. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans show 4 of 91 security vendors flagging the domain, and AlienVault OTX includes it in one threat pulse. The infrastructure is recent, with the registration date only weeks before the report date, suggesting a fast‑deployment phishing campaign. Defenders should add light‑promax.net to web‑filter deny lists, monitor outbound traffic for connections to the IP address 104.26.1.238, and enforce credential‑reuse controls for VPN services. Further analysis of the landing page is required to determine the exact credential fields being harvested.