lighetre[.]xyz

Analysis of lighetre.xyz shows a high‑risk, active infrastructure that aligns with a crypto‑focused phishing campaign. The domain was registered through Web Commerce Communications Limited and created on October 26, 2024. It resolves to 172.67.195.54, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. Both authoritative nameservers—gannon.ns.cloudflare.com and lilyana.ns.cloudflare.com—are hosted on Cloudflare, indicating the use of a reputable CDN for traffic acceleration and potential anonymity.

The site serves HTTPS content with a valid Google Trust Services / WE1 certificate, and the HTTP response code is 200, confirming successful delivery of the page. The page title returned is "Lighter," and the front‑end stack includes jsDelivr, crypto‑js, cdnjs, Cloudflare, and HTTP/3, suggesting reliance on widely used JavaScript libraries and modern protocol support. VirusTotal scans have flagged the domain on six of ninety‑three vendor engines, and the domain appears on two external blocklists, specifically PhishDestroy and ScamSniffer. A Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the site.

The intelligence categorises the operation as a crypto scam, consistent with the observed use of crypto‑js and the broader trend of cryptocurrency‑related phishing. While the exact phishing lure (e.g., wallet credential harvest) has not been disclosed, the combination of a legitimate‑looking SSL certificate, CDN protection, and a generic page title is typical of credential‑stealing infrastructure. Defenders should immediately block lighetre.xyz at the network perimeter and DNS resolver level, add the address 172.67.195.54 to any malicious IP watchlists, and monitor for future resolution changes. Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds are recommended to capture any evolution of the campaign.