lbplay555[.]xyz

The domain lbplay555.xyz has been identified as a credential theft phishing site, specifically impersonating LuckyBear Casino to harvest user login credentials. Analysis indicates the infrastructure was designed to mimic legitimate casino authentication portals, leveraging psychological incentives such as "Recharge Rewards up to 360%" to lure victims. The domain is currently offline, though its operational status may change without notice. Infrastructure analysis reveals the domain was registered through Namecheap on January 22, 2026, and resolved to the IP address 45.59.170.99. The site employed a Let's Encrypt SSL certificate, a common tactic to appear legitimate, and utilized technologies including Node.js, React, Nginx, Next.js, reCAPTCHA, Google Tag Manager, and Webpack. Despite its sophisticated setup, the domain was flagged by 0 of 95 VirusTotal vendors, indicating low initial detection rates. It appeared on one security blocklist and received a trust score of 0/100 from Gridinsoft, further corroborating its malicious nature. Given the domain's current offline status, organizations should monitor for reactivation or similar infrastructure. Defenders are advised to block the IP address 45.59.170.99 and domain lbplay555.xyz at the network level. End-users should be educated on recognizing credential theft tactics, particularly those involving fake login portals and unrealistic reward offers. Security teams are encouraged to review logs for connections to the identified IP and domain, as well as to hunt for related indicators of compromise within their environments.