lbsinvestment[.]com

PhishDestroy identifies lbsinvestment.com as a live crypto drainer infrastructure deployed to siphon cryptocurrency from unwitting visitors. The domain resolves to IP 188.114.97.3 and terminated with a Let’s Encrypt SSL certificate, lending a veneer of legitimacy often exploited to bypass browser warnings. Despite zero detections on VirusTotal and no presence on public blocklists at this moment, the domain’s age—registered on December 15, 2005 via GoDaddy.com, LLC—has likely flown under the radar long enough to accumulate trust in some threat-intelligence feeds. Technical indicators further support classification of this domain as an active cryptocurrency-draining campaign. The absence of detections (1/95 engines on VirusTotal) suggests either a newly deployed kit or a subtle evasion mechanism, such as dynamic content delivery or staged redirection. The long-standing registration date contrasts with the fresh appearance of malicious artifacts, hinting at domain squatting followed by recent compromise or repurposing. Additionally, the use of a valid Let’s Encrypt certificate enables HTTPS validation, reducing user suspicion while facilitating covert exfiltration of wallet credentials or seed phrases. Users who accessed lbsinvestment.com should immediately disconnect any connected wallets, revoke any permissions granted to the site, and scan local systems for unauthorized cryptocurrency-related processes. Run a full antivirus sweep and inspect browser extensions for unknown or recently installed tools. Report the domain through PhishDestroy’s verification portal to aid in rapid takedown and prevent wider compromise. Given the active status and low detection rate, assume your digital assets may still be at risk even if no immediate loss is observed.