lobstrwealletti[.]gitbook[.]io

The domain lobstrwealletti.gitbook.io is currently active and has been classified as a high‑risk generic phishing site. The public page title reads “Lobstr Wallet | - The Best Simple and Secure Stellar Wallet | lobstr wallet”, which mimics the branding of a legitimate Stellar wallet service. The site is listed on three security blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL. The domain was registered on May 06 2026 through the GitBook platform, a service that provides free hosting for documentation sites. DNS resolution points to the IP address 172.64.147.209, which belongs to Cloudflare, Inc. in Canada. The HTTPS certificate is issued by Google Trust Services under the WE1 root, and the server returns an HTTP 307 temporary redirect, a pattern often used to forward victims to malicious payloads while preserving the original URL. Gridinsoft assigns a trust score of 0 / 100, indicating a complete lack of reputation. VirusTotal scans show that 4 of 95 security vendors flag the domain, providing limited but concrete detection of malicious behavior. The low number of detections may reflect the recent creation date, but the presence of a legitimate‑looking wallet page, combined with the active blocklist entries, suggests a deliberate attempt to harvest credentials or private keys from unsuspecting users. No additional infrastructure such as command‑and‑control servers or known phishing kits has been observed, leaving the full scope of the operation uncertain. Defenders should treat any traffic to lobstrwealletti.gitbook.io as hostile. Immediate actions include adding the domain to network‑level deny lists, updating email filters to catch references to “Lobstr Wallet”, and monitoring for credential‑theft attempts targeting Stellar accounts. End‑users must be warned that the legitimate Lobstr wallet does not use a GitBook subdomain, and any request to this URL should be rejected. Continuous re‑evaluation is advised as further indicators may emerge.