lyrevexy[.]com

PhishDestroy identifies lyrevexy.com as an active credential theft domain designed to harvest login credentials from unsuspecting users. The site, registered on May 5, 2026, poses as a legitimate service to deceive victims into surrendering sensitive information. This domain should be treated as a high-risk threat due to its clear intent to facilitate unauthorized access to user accounts. This domain was flagged with 0 detections out of 95 VirusTotal scans, indicating minimal detection by security vendors. It resolves to IP 188.114.96.3 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain also holds a valid SSL certificate issued by Let's Encrypt, which may lend it an air of legitimacy to further deceive potential victims. To mitigate risks associated with credential theft, users should avoid interacting with lyrevexy.com entirely. Organizations and individuals are advised to block the domain at the network level and monitor for any attempted credential reuse across platforms. If credentials were entered, immediately rotate passwords and enable multi-factor authentication where possible. Report the domain to your security provider and relevant authorities to aid in broader threat intelligence efforts.