app[.]lighter-dex[.]mom

The domain app.lighter-dex.mom was registered on February 21, 2026 through PublicDomainRegistry.com (PDR Ltd.) and resolves to IP address 172.67.158.74, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. Authoritative nameservers are mitch.ns.cloudflare.com and hadlee.ns.cloudflare.com, indicating the site is fully proxied behind Cloudflare. An HTTPS certificate issued by Google Trust Services / WE1 is present, and the site serves content over HTTP/3 using Cloudflare Browser Insights and the jsDelivr CDN. The HTTP response code is 200 and the page title returned is "3.1374 • LIT/USDC • Lighter"; no further page content has been disclosed. The domain is listed on two security blocklists (PhishDestroy and ScamSniffer) and has a Gridinsoft trust score of 0/100. VirusTotal analysis shows five of ninety‑three scanners flag the domain as malicious. Risk level is classified as high and the infrastructure remains active. While the exact phishing payload or targeted brand cannot be confirmed from the available data, the combination of a recent registration, Cloudflare‑hosted infrastructure, a cryptocurrency‑related page title, and multiple detections strongly suggests a generic phishing operation. Defenders should block app.lighter-dex.mom at network perimeter, monitor DNS queries for the domain, and consider sinkholing the associated IP range. Continuous re‑evaluation is advised as additional indicators may emerge.