lbapp373[.]fit

Analysis of the domain lbapp373.fit indicates active credential phishing targeting users of gambling platforms. The domain, registered on January 22, 2026, through NAMECHEAP INC, currently resolves to the IP address 45.59.170.61, located in the Netherlands. Infrastructure analysis reveals the use of Cloudflare nameservers (buck.ns.cloudflare.com and erin.ns.cloudflare.com) and an SSL certificate issued by Let's Encrypt (R12). The site returns an HTTP 307 redirect status, a behavior often associated with phishing kits designed to evade detection or redirect victims to malicious endpoints. The domain is classified as part of the Gambler Scam phishing kit, a credential harvesting operation. The page title, 'LuckyBear Casino - Login and Authentication | Recharge Rewards up to 360%', explicitly references a gambling platform, suggesting an attempt to lure victims with promises of financial incentives. Detected technologies include Node.js, React, Next.js, Nginx, Google Sign-in, reCAPTCHA, and Google Tag Manager, which are consistent with modern phishing infrastructure designed to appear legitimate. As of July 12, 2026, the domain remains active and is flagged on one security blocklist (PhishDestroy). Three out of 91 security vendors on VirusTotal have detected the domain as malicious, though this number may not reflect its full risk profile. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. Defenders should treat this domain as an active threat, block it at the network level, and monitor for related indicators of compromise, including the associated IP address and phishing kit artifacts. Additional analysis of the site's content and backend infrastructure is recommended to identify further connections to this campaign.