lighret[.]xyz

This domain, lighret.xyz, is identified as a generic phishing infrastructure designed to impersonate a retail platform under the pretext of selling lighters or related merchandise. Analysis indicates the site likely functions as a credential harvester or payment skimmer, targeting users who input login details, personal information, or financial data during checkout processes. The domain’s deceptive design and lack of legitimate business affiliation suggest it operates solely to capture sensitive user data for fraudulent purposes. Evidence supporting this assessment includes detection by 5 out of 95 security vendors on VirusTotal, a trust score of 0/100, and presence on one security blocklist. The domain was registered on July 25, 2025, through NameCheap, Inc., a registrar frequently associated with newly created phishing domains. Infrastructure analysis reveals hosting on Amazon Web Services, with resolution to IP address 172.67.183.43, and use of technologies such as Amazon CloudFront, S3, and AWS Certificate Manager. The SSL certificate is issued by Let’s Encrypt, a common choice for threat actors due to its free and automated issuance process. Users who visited lighret.xyz should assume potential exposure of entered credentials or payment details. Immediate actions include resetting passwords for any accounts accessed on the site, monitoring financial statements for unauthorized transactions, and running a full antivirus scan to detect malware. Browser data should be cleared to remove any stored session tokens or cookies associated with the domain. If payment information was submitted, contacting the financial institution to report potential fraud and request card replacement is advised. Organizations should update blocklists to include this domain and its resolving IP to prevent further access.