lighter-litpass[.]com

Analysis of lighter-litpass.com shows a short‑lived domain created on 21 February 2026 through NiceNIC International Group Co., Limited. The zone is served by Cloudflare, using the authoritative nameservers stan.ns.cloudflare.com and tess.ns.cloudflare.com, and resolves to IP 104.21.71.140, which belongs to AS13335 Cloudflare, Inc. The site presents an HTTPS endpoint signed by Google Trust Services (WE1) and enforces HSTS, while also supporting HTTP/3. An HTTP request returns a 403 status code, indicating the resource is currently inaccessible; the domain is reported as offline. The page title returned is "Lighter", and the listed brand target is "base", classifying the activity as a brand‑impersonation scam.

Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 / 100. The domain appears on two public blocklists—PhishDestroy and ScamSniffer—and is recorded on two additional security blocklists. VirusTotal scans show five of ninety‑three security vendors flagging the domain as malicious. The risk level is elevated.

Defenders should continue to block the domain at perimeter filters, update URL reputation feeds with the current blocklist entries, and monitor the associated Cloudflare IP for any resurgence of activity. Since the site currently returns 403 and is offline, further content analysis is not possible, and the exact phishing payload or credential‑harvesting mechanisms remain unknown. Ongoing surveillance of the registrar, DNS changes, and any re‑use of the underlying Cloudflare infrastructure is advised to detect potential re‑activation.