luckybear555[.]site

This domain, luckybear555.site, is flagged as an active high-risk credential phishing site targeting users through a gambling-themed scam. Registered on January 22, 2026, via NAMECHEAP INC, the domain resolves to IP 45.59.170.96, hosted in the Netherlands (A.I.A), and uses Cloudflare nameservers (buck.ns.cloudflare.com, erin.ns.cloudflare.com). Infrastructure analysis reveals the use of Node.js, React, Nginx, Next.js, reCAPTCHA, Google Tag Manager, and Webpack, suggesting a modern, obfuscated phishing kit deployment. The page title, 'LuckyBear Casino - Login and Authentication | Recharge Rewards up to 360%', explicitly indicates a gambling-related credential harvesting scheme, classified under the 'Gambler Scam' phishing kit. The domain currently returns an HTTP 307 redirect status, a technique often employed to evade detection or route victims to malicious endpoints. SSL certification is provided by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility. As of July 12, 2026, the domain remains active and appears on one security blocklist. Sixteen of 91 security vendors on VirusTotal flag this domain as malicious, corroborating its classification as a phishing threat. Defenders should prioritize blocking this domain at the DNS or proxy level, particularly in environments where gambling or financial transactions are common. Further investigation into associated IPs, SSL certificates, and phishing kit artifacts is recommended to identify linked infrastructure. The exact content and payload delivery mechanisms of the site have not yet been analyzed, limiting deeper behavioral insights.