llythor[.]pro

PhishDestroy identifies the domain llythor.pro as an active credential theft phishing campaign. This domain is designed to impersonate a legitimate service to harvest user credentials, posing an elevated risk to victims. The threat remains active as of the latest analysis. This domain was flagged by 2 of 95 VirusTotal security vendors, indicating limited but confirmed malicious activity. The domain resolves to IP address 88.223.84.57, was registered through HOSTINGER operations, UAB, and obtained an SSL certificate from Let's Encrypt. The domain was created on January 04, 2026, and currently remains unblocked by major threat intelligence platforms. As this threat is active, users are strongly advised to avoid accessing llythor.pro and to report the domain to their security teams or threat intelligence platforms. Organizations should consider blocking the domain and IP address at the network perimeter to prevent potential credential theft or further compromise.