lobstrlogi-portal[.]webflow[.]io

PhishDestroy identifies lobstrlogi-portal.webflow.io as a credential theft campaign impersonating the legitimate Lobstr cryptocurrency platform to harvest user login details and session tokens. This domain mimics official Lobstr branding and workflow interfaces to deceive victims into entering sensitive credentials, which are then exfiltrated to attacker-controlled infrastructure. The threat is particularly dangerous due to its professional design and use of Webflow’s hosting infrastructure, which may bypass traditional email filtering systems. This domain was flagged through automated threat detection pipelines and shows no current detections on VirusTotal (2/95 engines), indicating it remains under the radar. The site resolves to IP 172.64.151.8 and uses a valid SSL certificate issued by Google Trust Services, further enhancing its credibility. While the exact creation date is not available in public records, the domain’s recent appearance and active threat status suggest it is part of a newly deployed campaign targeting cryptocurrency users. Users who visited lobstrlogi-portal.webflow.io should immediately revoke any active sessions associated with Lobstr or similar cryptocurrency platforms, change passwords using a clean device, and monitor accounts for unauthorized transactions. Enable multi-factor authentication where available and consider using a hardware wallet for enhanced security. Report the domain to your IT security team or cloud provider for blocking to prevent further exposure.