ligyter[.]xyz

The domain ligyter.xyz is currently listed as active in a generic phishing investigation. Registration records show the domain was created on 22 July 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. Authoritative nameservers are eugene.ns.cloudflare.com and olga.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. DNS resolution points the domain to the IPv4 address 188.114.97.3.

VirusTotal has processed the hostname with scans from 91 vendors; none of the vendors reported a detection at the time of analysis. Although the absence of detections does not imply safety, it is a data point that should be logged. The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one threat‑intelligence feed has identified it as malicious. No public Safe Browsing, Open Threat Exchange (OTX), SSL certificate, HTTP status code, or page‑title information is presently available for ligyter.xyz, and no additional evidence links have been published.

Consequently, the full payload, lure technique, or targeted brand cannot be confirmed at this stage. Defenders should treat ligyter.xyz as a high‑confidence phishing indicator. Recommended actions include adding the domain and its resolving IP address (188.114.97.3) to web‑filter block lists, monitoring DNS queries for any internal resolution attempts, and employing sandbox or URL‑reputation services for any future content fetched from the host. Continuous re‑scanning with multi‑vendor services and periodic checks against threat‑intel feeds are advised to capture any evolution of the campaign.