lihgter-dex[.]xyz

The domain lihgter-dex.xyz was observed to host a generic phishing page titled “Lighter” before being taken offline prior to the report date of 25 July 2026. Registration information shows the domain was created on 26 December 2025 through Web Commerce Communications Limited. No TLS certificate is associated with the host, indicating that HTTPS was not configured at the time of observation. The authoritative name servers are angelina.ns.cloudflare.com and ray.ns.cloudflare.com, which resolve the domain to the IP address 172.67.149.200, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. Reputation services provide consistent signals of malicious intent.

The Gridinsoft trust score is 0 out of 100. VirusTotal recorded eight positive detections out of ninety‑three scanning engines. Five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have listed the domain, and it appears on a total of five security blocklists. The lack of an SSL certificate, combined with the low trust score and multiple detections, reinforces the elevated risk rating assigned to the domain. Evidence is limited to the page title and infrastructure attributes; the actual page content, phishing kit, or targeted brand have not been publicly disclosed, leaving the precise attack vector uncertain.

Defenders should immediately block the domain name and the associated IP address at network perimeters, DNS resolvers, and endpoint protection solutions. Monitoring for additional domains registered by the same registrar or employing the same Cloudflare name servers may uncover related infrastructure. Continuous re‑scanning of the IP address is advised, as Cloudflare hosts many unrelated services and the address could be reused. Organizations that rely on URL filtering should ensure the domain is included in their deny lists and that any residual cached entries are purged.