events-lighter[.]xyz

The domain events-lighter.xyz was created on 21 February 2026 and is currently offline. It resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The hosting infrastructure uses Cloudflare’s DNS service, as indicated by the authoritative nameservers barbara.ns.cloudflare.com and coen.ns.cloudflare.com, and the site presents HSTS and HTTP/3 capabilities. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint at the time of observation.

The page title returned by the server is "Lighter - Trade Perpetuals," suggesting an attempt to lure victims with a financial‑trading narrative. Reputation checks show that three independent security blocklists have listed the domain, and it has been flagged by the PhishDestroy, MetaMask, and SEAL blocklists. VirusTotal scans recorded five detections out of ninety‑three security vendors, reinforcing the malicious classification.

Registration was performed through NiceNIC International Group Co., Limited. While the site is no longer reachable, the combination of recent domain registration, Cloudflare‑based hosting, valid SSL, and multiple blocklist entries provides a clear indication of a phishing infrastructure targeting users interested in trading platforms. Defenders should continue to deny network connections to 188.114.96.3, add events-lighter.xyz to local deny lists, and monitor for any re‑registration attempts or similar domain patterns that may be used in future campaigns.