mainnet-lighter[.]xyz

This domain, mainnet-lighter.xyz, operates as a cryptocurrency drainer specifically targeting users of the Base blockchain platform. The site presents itself as a legitimate Base-related service under the page title 'Lighter,' but its true function is to execute unauthorized transactions that siphon digital assets from connected wallets. Analysis indicates the site employs typical drainer tactics, including wallet connection prompts and transaction signing requests that appear benign but contain malicious payloads designed to transfer funds without user consent. The threat is classified as high-risk due to its active status and direct targeting of cryptocurrency holdings, which can result in immediate, irreversible financial loss. Technical indicators confirm the malicious nature of this domain. As of the latest assessment, 8 out of 95 security vendors on VirusTotal have flagged mainnet-lighter.xyz as malicious, with detections spanning categories such as phishing, brand impersonation, and cryptocurrency fraud. The domain was registered on February 21, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335), a common obfuscation technique to mask the true origin of malicious infrastructure. Additionally, the domain appears on five security blocklists, and its lack of an SSL certificate further undermines its legitimacy, as modern secure sites universally implement HTTPS. Users who have interacted with mainnet-lighter.xyz should take immediate action to mitigate potential damage. First, disconnect any wallets that were linked to the site and revoke any suspicious token approvals or smart contract interactions using a blockchain explorer or wallet management tool. Monitor all connected accounts and devices for unauthorized transactions or signs of compromise, such as unexpected wallet balance changes or unfamiliar dApps appearing in wallet histories. If funds were transferred, report the incident to relevant cryptocurrency exchanges and consider filing a report with local cybercrime authorities. To prevent future exposure, verify domain authenticity before connecting wallets, use hardware wallets for high-value assets, and rely on official sources for blockchain-related services. The domain remains active, so caution is advised to avoid further interactions.