lbgo373[.]live

This domain, lbgo373.live, is flagged as an active credential phishing site targeting users of online gambling platforms. Registered on January 22, 2026, through NameCheap, Inc., the domain resolves to the IP address 45.59.170.102, located in the Netherlands. Infrastructure analysis reveals the use of Cloudflare nameservers (buck.ns.cloudflare.com and erin.ns.cloudflare.com) and a Let's Encrypt SSL certificate (R13), which are common in both legitimate and malicious operations but do not mitigate the confirmed threat. The site presents itself under the page title 'LuckyBear Casino - Login and Authentication | Recharge Rewards up to 360%', indicating an attempt to lure victims with promises of high-value rewards. The domain is classified as part of the 'Gambler Scam' phishing kit, a known framework for harvesting login credentials and financial information from users of gambling services. A 307 HTTP status code suggests temporary redirection, which may be used to obscure the final malicious destination or evade detection. Technical indicators include the use of Node.js, React, Nginx, Next.js, reCAPTCHA, Google Tag Manager, and Webpack, a stack consistent with modern web applications but also leveraged in phishing campaigns for scalability and obfuscation. The domain is currently blocked by at least one security vendor (PhishDestroy) and appears on a security blocklist. Three of 91 security vendors on VirusTotal have flagged the domain as malicious, though this count does not represent exhaustive detection. Defenders should treat lbgo373.live as an active, high-risk threat. Network-level blocking of the domain and its resolving IP (45.59.170.102) is recommended. Organizations with gambling-related services or users should monitor for credential reuse or unauthorized access attempts linked to this infrastructure.