app[.]ligthere[.]xyz

The domain app.ligthere.xyz was registered on February 21, 2026 and, as of the report date of July 22, 2026, has been taken offline. Infrastructure analysis shows the domain resolves to IP address 104.21.7.138, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a TLS certificate identified as WE1, indicating a valid SSL handshake was available while the domain was active. Web‑page metadata captured the title "Lighter," but no further content details have been disclosed.

Threat intelligence flags the site as a crypto‑related scam, and the domain appears on two independent security blocklists. Both PhishDestroy and ScamSniffer list the domain as blocked, confirming its association with phishing‑type activity. VirusTotal analysis recorded four positive detections out of ninety‑three scanned scanners, reinforcing the malicious classification. Additionally, Gridinsoft assigned a trust score of zero out of one hundred, reflecting an extremely low reputation.

While the offline status limits immediate host interaction, defenders should continue to block any traffic to 104.21.7.138 associated with this hostname, update local and cloud‑based blocklists, and monitor for re‑use of the underlying Cloudflare IP range in future campaigns. Observers should also note the lack of additional public intelligence such as OTX tags or further URL paths, indicating that the current evidence set is limited to the recorded attributes. Continued vigilance is advised, especially for organizations that monitor crypto‑related phishing vectors, to prevent potential re‑deployment of the same infrastructure.