litghter[.]xyz

Analysis indicates that litghter.xyz was registered on May 25, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain employs nameservers leo.ns.cloudflare.com and phoenix.ns.cloudflare.com while resolving to the IP address 188.114.97.3 located in CA. An SSL certificate issued by Google Trust Services under the WE1 authority is present. The HTTP status code returned is 403, suggesting restricted access to the content. The domain maintains an active status and is associated with a generic phishing threat classification at a high risk level. VirusTotal reports show that 12 out of 95 security vendors flag this domain as malicious. It appears on 3 security blocklists and has been identified by additional blocking mechanisms. Infrastructure details point to Cloudflare usage through both the nameservers and the IP assignment. Defenders reviewing this domain should consider immediate blocking of the domain name and associated IP address in their security controls. Monitoring for any resolution changes or new subdomains is advisable given the active status. Further investigation into the specific phishing mechanisms may be warranted despite the 403 response, as the domain continues to be listed in threat intelligence sources. The exact nature of the hosted content remains uncertain due to access restrictions, requiring additional verification methods such as sandbox analysis if accessible through alternative means. The registration details and current infrastructure configuration provide concrete indicators for tracking similar domains in the future. Uncertainty exists around the operational lifespan and potential evolution of the threat since the creation date in 2026, with the high risk level supported by the vendor flags and blocklist presence rather than direct content observation.