# lighter-rewards.duckdns.org — Lighter Prover Challenge reward verification page | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/ Machine-readable companion: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-10-29 23:07:41 UTC - Selected availability observation: 2026-11-09T23:20:46Z - Stored record updated: 2026-11-10 03:23:24 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Wallet-drainer family: wallet_drainer ## Stored infrastructure - Observed IP address: 103.228.64.184 - Registrar in stored WHOIS data: DuckDNS - Last stored HTTP status: 200 (observed: 2026-11-09T23:20:46Z) - Registration date (registry RDAP, duckdns.org): 2013-04-12 19:58:56 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a189ea-7e1a-723e-bef8-81b1013a2f34/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/lighter-rewards.duckdns.org - Certificate Transparency search: https://crt.sh/?q=%25.lighter-rewards.duckdns.org - Web Archive lookup: https://web.archive.org/web/*/https://lighter-rewards.duckdns.org/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records lighter-rewards.duckdns.org, a page offering a Lighter Prover Challenge reward verification that asks visitors to connect a wallet. The captured page presents itself as a Lighter Prover Challenge reward verification screen, showing a pending 8,600 LIT reward with an approximate USD value. Its main interaction is a prominent "Connect Wallet to Verify" button, followed by a four-step list instructing the visitor to connect the wallet used to submit a solution, sign a verification message, confirm an on-chain ownership check, and receive an automatic reward transfer. A status strip below reports 2,847 LIT distributed this round, a countdown to the next batch, and a recent claim entry. The stored VirusTotal domain result reports 1 detection out of 92 engines. LevelBlue reported "phishing". Package revision: 54189de368f863dee265a3803c3ee3bda7779494ff390a113d9c1fc76c7b0d26 Text generated (not scan time): 2026-10-30 00:09:01 Reviewed evidence snapshot: {"domain":"lighter-rewards.duckdns.org","screenshot_available":true,"page_title":"Lighter Prover Challenge — Reward Verification","initial_ai_description":"The site prompts users to connect their wallet to 'verify' their reward, which is a common tactic used by crypto drainers to gain unauthorized access to a user's cryptocurrency wallet. The mention of 'Prize pool distribution' and 'Reward transfers to your address automatically' are lures.","initial_ai_description_kind":"previous AI opinion, not independent evidence","virustotal":{"detections":1,"engines":92,"malicious":1,"suspicious":0,"retrieved_date":"2026-10-30","analysis_date":"2026-10-18","flagging_vendors":["LevelBlue"],"vendor_labels":{"LevelBlue":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-10-29T23:08:18Z","final_host":"lighter-rewards.duckdns.org","captured_on":"2026-10-30"},"virustotal_public_summary":"The stored VirusTotal domain result reports 1 detection out of 92 engines. LevelBlue reported \"phishing\".","page_paragraph_target_characters":543} Source facts (timestamps as stored): {"record_id":1709267,"first_recorded_at":"2026-10-30 00:07:41","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":1,"denominator":92,"malicious":1,"suspicious":0,"vendors":{"LevelBlue":"phishing"},"observed_at":"2026-10-18T13:16:28Z","checked_at":null,"fetched_at":"2026-10-29T23:08:11Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":1,"denominator":92,"malicious":null,"suspicious":null,"vendors":["Forcepoint ThreatSeeker"],"observed_at":null,"checked_at":"2026-11-08 04:03:50","fetched_at":"2026-11-08 03:03:50","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"LevelBlue":"phishing"},"vendor_names":["LevelBlue"],"stats":{"timeout":0,"harmless":54,"malicious":1,"suspicious":0,"undetected":37}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-09 12:01:05"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-30 00:30:29"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1709267,"scope":"checked_url","observed_at":"2026-11-09T23:20:46Z","http_status":200,"http_observed_at":"2026-11-09T23:20:46Z","stored_http_code":200,"stored_http_observed_at":"2026-11-09T23:20:46Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"served_at_root","content_classification_at":"2026-11-09T11:19:01Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - Stored capture: https://i.ibb.co/qKLLj0B/e4823f996bab.png - URLScan · 2026-10-29: https://screenshots.phishdestroy.io/01a189ea-7e1a-723e-bef8-81b1013a2f34.png Captured: 2026-10-29 23:06:55 UTC Source report: https://urlscan.io/result/01a189ea-7e1a-723e-bef8-81b1013a2f34/ - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a1554b-df32-711f-9143-25752a1c98ae.png Captured: 2026-10-19 17:53:27 UTC Source report: https://urlscan.io/result/01a1554b-df32-711f-9143-25752a1c98ae/ SHA-256: 7d69346f5ce051e089b970d66b3d787cbbea39f698df1f0be9116d03ea295b6e - URLScan · 2026-10-29: https://screenshots.phishdestroy.io/us/01a189ec-df88-756d-86ea-f45547966ddf.png Captured: 2026-10-29 23:09:32 UTC Source report: https://urlscan.io/result/01a189ec-df88-756d-86ea-f45547966ddf/ SHA-256: d89b8e8e6e70eb182e6c775b00a757f53aaf99037a33aec4113bb7a720a4ed1f - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e0276f2e-76f9-4172-83a7-18f4f0d83fbe.png Captured: 2026-10-29 23:08:18 UTC Source report: https://radar.cloudflare.com/scan/e0276f2e-76f9-4172-83a7-18f4f0d83fbe SHA-256: 8f9460f519854358cae8b999ba72c2301ccae458f07366a0578cb2683874160b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-29T23:08:30Z", "uuid": "01a189ea-7e1a-723e-bef8-81b1013a2f34", "scanned_at": "2026-10-29T23:06:55Z", "final_url": "https://lighter-rewards.duckdns.org/", "status": 200, "ip": "103.228.64.184", "domains": [ "school-idle-specify-experimental.trycloudflare.com", "api.lighter-rewards.eu.org" ], "ips": [ "104.16.230.132", "103.228.64.184" ], "asns": [ "13335", "153706" ], "countries": [ "HK" ], "doc_hash": "79ce2d66b65ae0c83039163791837186c381bff03cd506c88658a18e9e795cf9", "tls": { "san": [ "lighter-rewards.duckdns.org" ], "cipher": "AES_256_GCM", "issuer": "ZeroSSL ECC DV SSL CA 2", "subject": "lighter-rewards.duckdns.org", "protocol": "TLS 1.3", "valid_to": "2027-01-15T23:59:59Z", "valid_from": "2026-10-17T00:00:00Z" }, "domain_age_days": 12, "apex_age_days": 12, "tls_age_days": 12, "tls_valid_days": 90, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.24.0 (Ubuntu)", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-29T23:08:32Z", "uuid": "e0276f2e-76f9-4172-83a7-18f4f0d83fbe", "scanned_at": "2026-10-29T23:08:18Z", "final_url": "https://lighter-rewards.duckdns.org/", "status": 200, "history": [ { "url": "https://lighter-rewards.duckdns.org/", "status": 200 } ], "dom_hash": "f3ccac91ec727c84aa3c3e139af50b44bd1c6ccc6bc2d3958ad47c8062840e39", "doc_hash": "79ce2d66b65ae0c83039163791837186c381bff03cd506c88658a18e9e795cf9", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "lighter-rewards.duckdns.org", "type": "A", "value": "103.228.64.184" } ], "dnssec_valid": false, "ip": "127.0.1.19", "whois": { "registrar": "Gandi SAS", "created": "2013-04-12T19:58:56Z", "updated": "2026-08-12T00:57:00Z", "expires": "2029-04-12T19:58:56Z", "nameservers": [ "ns1.duckdns.org", "ns2.duckdns.org", "ns3.duckdns.org", "ns5.duckdns.org", "ns6.duckdns.org", "ns4.duckdns.org" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-29T23:08:11Z", "analysis_at": "2026-10-18T13:16:28Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 1, "suspicious": 0, "undetected": 37 }, "detections": { "LevelBlue": "phishing" }, "reputation": 0, "registrar": "Gandi SAS", "created": "2013-04-12T19:58:56Z", "expires": "2029-04-12T19:58:56Z", "updated": "2026-08-12T00:57:00Z", "first_seen": "2026-10-17T17:21:22Z", "dns": [ { "ttl": 60, "type": "TXT", "value": "v=spf1 ip4:103.228.64.184 -all" }, { "ttl": 600, "type": "MX", "value": "lighter-rewards.duckdns.org", "priority": 50 }, { "ttl": 60, "type": "A", "value": "103.228.64.184" } ], "dns_at": "2026-10-18T13:16:48Z", "jarm": "28d28d28d00028d00042d42d000000831b6af40378e2dd35eeac4e9311926e", "cert": { "san": [ "lighter-rewards.duckdns.org" ], "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "serial": "5dfdf33a7d4761804735e274011e96ca", "sha256": "f442b31cce35e3a4d968fe9a179994692be8da17903ace07f02942c84f4ce2b6", "subject": "lighter-rewards.duckdns.org", "valid_to": "2027-01-15T23:59:59Z", "valid_from": "2026-10-17T00:00:00Z" }, "whois": { "registrar": "Gandi SAS", "registrar_iana_id": "81", "registrar_url": "http://www.gandi.net", "created": "2013-04-12T19:58:56Z", "updated": "2026-08-12T00:57:00Z", "expires": "2029-04-12T19:58:56Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.duckdns.org", "ns2.duckdns.org", "ns3.duckdns.org", "ns4.duckdns.org", "ns5.duckdns.org", "ns6.duckdns.org", "ns7.duckdns.org", "ns8.duckdns.org", "ns9.duckdns.org" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-29T23:08:46Z", "mail_config": { "mx": [ "lighter-rewards.duckdns.org" ], "spf": "v=spf1 ip4:103.228.64.184 -all", "spf_lookups": 0 }, "caa_records": { "domain": "lighter-rewards.duckdns.org" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "social_tags": { "title": "Lighter Prover Challenge — Reward Verification" }, "trackers": { "requests": 3 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 303, "tls": 214, "wait": 411, "connect": 202, "download": 34 }, "response_ms": 1164 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443, 3000, 8080 ] }, "carbon": { "bytes": 36573, "co2_grams": 0.0013, "cleaner_than": 44 }, "dns_server": { "ns": [ { "ip": "15.222.19.97", "host": "ns9.duckdns.org" }, { "ip": "99.79.143.35", "host": "ns1.duckdns.org" }, { "ip": "35.182.183.211", "host": "ns2.duckdns.org" }, { "ip": "35.183.157.249", "host": "ns3.duckdns.org" }, { "ip": "3.97.51.116", "host": "ns4.duckdns.org" }, { "ip": "99.79.16.64", "host": "ns5.duckdns.org" }, { "ip": "3.97.58.28", "host": "ns6.duckdns.org" }, { "ip": "15.223.21.81", "host": "ns7.duckdns.org" } ], "zone": "duckdns.org" }, "location": { "ip": "103.228.64.184", "asn": "153706", "org": "WGOC", "city": "Kwai Chung", "country": "HK" }, "ssl": { "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "subject": "lighter-rewards.duckdns.org" }, "dns": { "A": [ "103.228.64.184" ], "MX": [ "{\"exchange\": \"lighter-rewards.duckdns.org\", \"priority\": 50}" ], "TXT": [ "v=spf1 ip4:103.228.64.184 -all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "103.228.64.184", "family": 4 }, "redirects": { "chain": [ "https://lighter-rewards.duckdns.org" ] }, "headers": { "headers": { "server": "nginx/1.24.0 (Ubuntu)", "content-type": "text/html" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/cf/e0276f2e-76f9-4172-83a7-18f4f0d83fbe.png","source":"Cloudflare Radar","report_url":"https://radar.cloudflare.com/scan/e0276f2e-76f9-4172-83a7-18f4f0d83fbe","captured_at":"2026-10-29T23:08:18Z","sha256":"8f9460f519854358cae8b999ba72c2301ccae458f07366a0578cb2683874160b","model_image_sha256":"2a2665f088c4b4f968b9faf9a91447eb68504d8e75d4983a35b760ab28c39be4","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/lighter-rewards.duckdns.org/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1709267, "scope": "checked_url", "observed_at": "2026-11-09T23:20:46Z", "http_status": 200, "http_observed_at": "2026-11-09T23:20:46Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-09T23:20:46Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "served_at_root", "content_classification_at": "2026-11-09T11:19:01Z", "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```