h5[.]lbma[.]live

The domain h5.lbma.live has been identified as a generic phishing site, specifically designed to impersonate the London Bullion Market Association (LBMA). PhishDestroy analysts discovered this threat during routine monitoring of newly registered domains. The site attempted to harvest credentials or sensitive information from unsuspecting visitors by mimicking the legitimate LBMA platform. No specific drainer kit was identified, but the generic phishing nature suggests a broad targeting approach.

Technical analysis reveals that the domain was registered through NameCheap, Inc. and created on April 16, 2026. It resolves to IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services (WE1). VirusTotal shows 0 detections out of 95 scans, indicating it had not been flagged by security vendors at the time of analysis. However, the domain appears on 3 security blocklists, suggesting some threat intelligence sources had already identified it as malicious. The page title was set to "LBMA" to further deceive visitors.

As of the latest check, h5.lbma.live has been taken offline, reducing immediate risk to users. However, the domain remains under investigation as part of a broader campaign. PhishDestroy recommends that users who may have visited the site or entered credentials change their passwords immediately and enable multi-factor authentication. Organizations should block the domain and IP at the network level and monitor for any related phishing attempts. While the site is offline, the threat actors may register new domains using similar patterns, so continued vigilance is advised.