lighterliquid[.]xyz

On July 24, 2026, the domain lighterliquid.xyz was observed hosting a page titled “90.0550 SOLUSDT”. The site was registered on March 04, 2026 through NiceNIC International Group Co., Limited and uses Cloudflare’s authoritative nameservers carol.ns.cloudflare.com and matt.ns.cloudflare.com. DNS resolution points to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was presented; the service responded without HTTPS, indicating a lack of encryption. The domain has been taken offline at the time of analysis, and its HTTP status is therefore unavailable.

Security telemetry shows that lighterliquid.xyz appears on three public blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report that four of ninety‑four anti‑malware engines flagged the domain, providing additional confirmation of malicious intent. The page title referencing SOLUSDT suggests an attempt to lure victims with a cryptocurrency‑related offer, consistent with generic phishing campaigns that target crypto wallets. Evidence gaps remain: the exact content of the landing page, any credential‑harvesting forms, and the presence of malicious payloads have not been captured because the site is offline.

Consequently, the full scope of the phishing kit or any downstream infrastructure cannot be conclusively described. Defenders should continue to block the domain at DNS and web‑filter layers, monitor for any re‑registration attempts, and add the associated IP address 188.114.97.3 to threat‑intel feeds. Given the Cloudflare hosting, future malicious sites may reuse the same IP range, so broader network‑level controls for AS13335 traffic are advisable. Analysts should also watch for variations of the “SOLUSDT” keyword in new phishing URLs, as this pattern may indicate a recurring campaign.