app[.]xn--lightr-t3a[.]co

The domain app.xn--lightr-t3a.co has been identified as a generic phishing threat, impersonating the Lighter.xyz brand. This domain was designed to deceive users by mimicking legitimate project overview pages, potentially to harvest sensitive information. Although the specific brand being impersonated is Lighter.xyz, there is no indication of a specific drainer kit associated with this domain. The domain's deceptive nature is underscored by its misleading page title, Lighter.xyz Project Overview.

Technical analysis of app.xn--lightr-t3a.co reveals several indicators of malicious activity. VirusTotal reports that 7 out of 95 security vendors flagged this domain as malicious, highlighting its potential threat. The domain was registered through Dynadot Inc and resolves to the IP address 188.114.96.3. It was created on April 05, 2026, and uses a Let's Encrypt SSL certificate, which may lend a false sense of security to unsuspecting users. Additionally, the domain appears on one security blocklist, providing further evidence of its malicious intent.

The current status of app.xn--lightr-t3a.co is offline, following intervention and blocking by PhishDestroy. Despite being taken down, the domain's prior activity indicates a significant risk, as it may have already compromised users who visited while it was operational. Continuous monitoring and reporting to security vendors are recommended to ensure the domain remains offline and to prevent similar threats. Users are advised to remain vigilant and verify the legitimacy of domains before interacting with them.