ligthes[.]xyz

The domain ligthes.xyz was registered on 29 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is presently offline. DNS resolution points to the IP address 192.178.155.103, which is allocated to AS15169 owned by Google LLC and geolocated in the United States. The domain uses Cloudflare’s authoritative nameservers elle.ns.cloudflare.com and leonard.ns.cloudflare.com, but it does not present an SSL/TLS certificate, leaving the connection unencrypted. The sole page title retrieved from the site reads “Google,” matching the declared brand target and confirming the classification as a brand‑impersonation campaign.

Gridinsoft’s trust scoring system assigned a zero‑score (0/100), indicating an extremely low reputation. The site has been flagged by four of ninety‑three VirusTotal scanners, and it appears on a single external security blocklist. PhishDestroy has also taken the domain offline and listed it as a blocked resource. These indicators collectively confirm that ligthes.xyz was employed to masquerade as a Google service, likely to harvest credentials or deliver malicious payloads.

Because the domain is no longer reachable, immediate mitigation focuses on ensuring that any residual DNS or IP entries are blocked at the network perimeter and that endpoint protection solutions are updated with the observed indicator set. Security teams should also monitor for re‑use of the underlying IP address or Cloudflare nameserver configuration in future campaigns, and they should add ligthes.xyz to internal blocklists to prevent accidental reconnection. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related infrastructure, and analysts should verify that existing URL filtering and safe‑browsing controls correctly flag the domain as malicious.