lobstrswallet[.]webflow[.]io

The domain lobstrswallet.webflow.io has been classified as a high‑risk crypto‑drainer aimed at users of the Lobstr XTZ wallet. The site’s page title, "Lobstr Wallet - The Leading XTZ Crypto Wallet," directly references the targeted brand, indicating an intent to deceive legitimate users. Technical analysis shows the domain resolves to the IPv6 address 2a06:98c1:3105::6812:24f8, hosted on Cloudflare infrastructure (AS13335) located in the United States. The SSL certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid TLS chain despite the malicious purpose.

Nameserver records point to journey.ns.cloudflare.com and lamar.ns.cloudflare.com, both Cloudflare‑controlled, which is consistent with the hosting profile. The site returned an HTTP 404 status at the time of inspection and is currently taken offline, limiting direct content analysis; however, the page title and threat classification remain observable. VirusTotal scans flagged the domain by 16 of 91 security vendors, reinforcing the malicious assessment. The domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple protective services have recognized it as a threat.

Registration was performed through MarkMonitor, Inc. on May 08, 2013, and the domain’s Gridinsoft trust score is 0 out of 100, reflecting a lack of trustworthiness. Defenders should immediately block lobstrswallet.webflow.io at DNS and proxy layers, add the address to endpoint and network threat‑intel feeds, and monitor for any residual traffic attempting to contact the associated IPv6 host. Continuous observation of Cloudflare‑hosted IP ranges for similar phishing‑oriented subdomains is advised, as the infrastructure is reusable for future campaigns.