lbjoy555[.]xyz

This domain, lbjoy555.xyz, is an active phishing site specifically targeting users of LuckyBear Casino by presenting fraudulent login and authentication pages. The site falsely advertises "Recharge Rewards up to 360%" to lure victims into entering credentials or financial information. Analysis confirms this as a generic phishing threat with elevated risk due to its deceptive branding and active status. Infrastructure analysis reveals the domain was registered on January 22, 2026, through NAMECHEAP INC, resolving to the IP address 45.59.170.102, located in the Netherlands. The domain is currently flagged by 9 of 95 security vendors on VirusTotal, with only 1 security blocklist listing it. It employs a Let's Encrypt SSL certificate (R13), which may create a false sense of security for unsuspecting users. The page title explicitly mimics LuckyBear Casino's branding, further confirming its intent to impersonate legitimate services. The domain remains active and poses a significant credential harvesting risk. Organizations and users are advised to block the domain and its associated IP (45.59.170.102) at the network level. End-users should avoid interacting with the site, particularly entering login credentials or financial details. Security teams are recommended to monitor for related indicators, including the domain's creation date (2026-01-22) and registrar details, to prevent further exploitation attempts.