# PhishDestroy threat dossier — h5.lbma.live ================================================================ Fetched: 2026-05-02 06:36:10 UTC Canonical: https://phishdestroy.io/domain/h5.lbma.live/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 60/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/94 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: NameCheap, Inc. Nameservers: ["nitin.ns.cloudflare.com", "sandra.ns.cloudflare.com"] Registered: 2026-04-16 Page title: LBMA HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-06-17 Status: INVALID chain Fingerprint: 82376c1a7adc9c044afb3f57b93b790be5de897b39a5238471b6e8ee029a691e Subject Alternative Names (related infrastructure — often same operator): - lbma.live ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-16 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-16 18:47:07 UTC (by PhishDestroy tracker) Last verified: 2026-05-02 05:02:01 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d96f8-7f41-732e-b501-cceabf6f65ce/ Wayback Machine: https://web.archive.org/web/*/h5.lbma.live crt.sh CT logs: https://crt.sh/?q=%25.h5.lbma.live Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=h5.lbma.live AlienVault OTX: https://otx.alienvault.com/indicator/domain/h5.lbma.live URLhaus: https://urlhaus.abuse.ch/host/h5.lbma.live/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-16 18:47:59 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies h5.lbma.live as an active cryptocurrency drainer kit distribution domain. The site masquerades as a legitimate blockchain or wallet service to trick users into connecting wallets and draining cryptocurrency assets. No specific brand is mimicked in the current operation, suggesting opportunistic targeting. The domain leverages a minimal subdomain path (h5.) to appear as a component of a larger, possibly compromised infrastructure (lbma.live). This structure is commonly used to evade detection and obfuscate the true origin of the malicious payload. Threat actors behind this campaign are likely employing automated scripts to harvest private keys or initiate fraudulent transactions once wallet connections are established. This domain resolves to IP address 188.114.97.3 and operates under a Google Trust Services SSL certificate, which may be abused to lend false credibility to the phishing operation. VirusTotal currently shows 0 out of 95 security vendors flagging the domain as malicious, indicating a low detection rate and a window of opportunity for threat actors. The domain was created recently, though exact creation date is not publicly available. It remains unblocked by Google Safe Browsing (GSB) and has not yet been listed on major threat intelligence blocklists, further increasing its potential reach among unsuspecting users. This low visibility poses a significant risk to cryptocurrency holders engaging with the site. The domain remains active and under active investigation as of this report. Immediate remediation is recommended, including network-level blocking and user awareness campaigns targeting cryptocurrency users. Although the risk level is currently marked as 'under_investigation,' the presence of a drainer kit and the domain's low detection rate elevate the threat to critical for individuals interacting with digital assets. Users are advised to avoid visiting h5.lbma.live and to report any suspicious interactions. Security teams should monitor for related infrastructure and update blocklists accordingly. The remaining risk is high due to the domain's active status and the absence of widespread detection. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 52fcbdc9b89c76570a1246925d321d0d TLS cert SHA-256: 82376c1a7adc9c044afb3f57b93b790be5de897b39a5238471b6e8ee029a691e ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/h5.lbma.live/ JSON API: https://api.destroy.tools/v1/check?domain=h5.lbma.live Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io