lightor[.]xyz

This domain, lightor.xyz, is identified as a credential harvesting phishing site designed to capture sensitive user login information. Analysis indicates no direct association with a specific brand or drainer kit, though its infrastructure aligns with common phishing frameworks used for large-scale credential theft. The domain was likely deployed to mimic legitimate login portals, exploiting visual or URL-based deception to trick victims into submitting credentials. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 54.215.31.113 and was registered through Dynadot LLC on March 28, 2026. Security vendor detections on VirusTotal report 4/95 flags, while threat intelligence platforms confirm its presence in one AlienVault OTX pulse. The domain appears on a single security blocklist and was actively blocked by endpoint protection systems prior to takedown. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. Current status indicates the domain has been taken offline, likely following detection and reporting by security teams. While the immediate threat is mitigated, residual risk remains due to potential reuse of the infrastructure or registration of similar domains. Organizations are advised to monitor for related indicators, including the associated IP address and registrar patterns, and to implement proactive blocking of newly registered domains with matching characteristics. Users should verify login portals through official channels and report suspicious domains to security providers for further analysis.