event-lobstar[.]fun

event-lobstar.fun is currently offline but historical data indicate that the domain was used for a crypto‑related phishing campaign targeting users with an airdrop narrative. The site resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. DNS resolution was provided by the Cloudflare nameservers lennox.ns.cloudflare.com and raquel.ns.cloudflare.com. The domain was registered on 28 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com.

No TLS certificate was observed, indicating that the site was served over plain HTTP. The page title returned by the server was “Lobstar | Airdrop”, matching the known phishing kit labeled “Airdrop Scam” and confirming the classification as a crypto scam. The domain appears on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—demonstrating that multiple threat‑intelligence feeds have flagged it. VirusTotal analysis shows that two of ninety‑three scanners flagged the domain, providing additional corroboration of malicious intent.

Despite the limited detection count, the convergence of blocklist listings, the use of a known airdrop phishing kit, and the absence of encryption collectively raise the risk profile to elevated. Uncertainty remains regarding the current activity of the infrastructure; the domain is offline and no recent HTTP response codes are available, so it is unclear whether the operators have shifted to a new host or are temporarily dormant. Defenders should continue to block the domain and its associated IP address, monitor the Cloudflare nameservers for any re‑registration, and incorporate the observed indicators—domain name, IP, page title, and blocklist entries—into intrusion‑detection signatures and URL filtering policies. Ongoing vigilance is advised, particularly for wallets or services that interact with airdrop claims, to prevent credential harvesting or unauthorized token transfers.