llgther[.]xyz

This domain, llgther.xyz, is identified as a generic_phishing threat specializing in credential harvesting, likely targeting cryptocurrency wallet users. Analysis indicates no direct association with known legitimate brands, though the infrastructure mimics common wallet or exchange login portals. The absence of a recognized drainer kit signature suggests a custom or lightly modified phishing framework designed to evade basic detection mechanisms. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026. It resolves to the IP address 172.67.215.90, a Cloudflare proxy endpoint commonly exploited to obscure hosting origins. At the time of assessment, the domain was flagged by 4 out of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appears on three distinct security blocklists and is actively blocked by cryptocurrency-specific security layers, including MetaMask and SEAL. The domain has since been taken offline, though residual risk persists due to the ephemeral nature of phishing infrastructure. Historical resolution data and registrar records indicate a pattern of rapid deployment and abandonment, a tactic used to minimize forensic traceability. Users who interacted with the domain prior to its deactivation are advised to revoke any active sessions, rotate credentials, and monitor for unauthorized transactions. Continuous vigilance is recommended, as related domains may emerge using similar naming conventions or infrastructure.