app[.]ligtherapp[.]xyz

Analysis of app.ligtherapp.xyz indicates that the domain was created on February 21, 2026 and is currently taken offline. The domain resolves to the IP address 172.67.196.95, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, meaning the site operates without HTTPS encryption. The page title returned from the server is "Lighter," and the domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com.

Infrastructure inspection shows that the authoritative nameservers are kolton.ns.cloudflare.com and ryleigh.ns.cloudflare.com, confirming the use of Cloudflare's DNS service. The site has been classified as a wallet/seed phishing operation that impersonates the Discord brand, targeting users who may be prompted to disclose cryptocurrency seed phrases. Security monitoring services have recorded four of ninety‑three VirusTotal scanners flagging the domain as malicious, and the domain appears on two public security blocklists. It is also listed as blocked by PhishDestroy and ScamSniffer.

Independent trust scoring assigns a Gridinsoft score of 0 out of 100, indicating a high likelihood of malicious intent. While the exact content of the page has not been captured, the available indicators—brand impersonation, lack of SSL, low trust score, and multiple vendor detections—support a conclusion of elevated risk. Defenders should block the domain and its associated IP address at network perimeters, add the domain to internal phishing and malware blocklists, and monitor for any future re‑registration or similar domains using the same registrar or Cloudflare infrastructure. Continued observation of the IP range 172.67.196.0/24 for related activity is also recommended.