lobsterwallrt[.]webflow[.]io

PhishDestroy identifies lobsterwallrt.webflow.io as a credential phishing domain under active investigation. This Webflow-hosted page mimics legitimate login portals to harvest user credentials, posing a direct risk to personal and corporate accounts. No specific brand or drainer kit has been confirmed at this time, but the threat actor's tactics suggest a focus on credential harvesting through deceptive form submissions. This domain resolves to IP 104.18.36.248 and operates under a Google Trust Services SSL certificate for added legitimacy. VirusTotal currently flags the domain with 6/95 detections, indicating it has evaded initial detection systems. The domain was registered via Webflow's platform and remains unlisted on Google Safe Browsing (GSB) and other major blocklists as of this analysis. The threat remains active with no confirmed takedown or mitigation in place. Users should avoid interacting with lobsterwallrt.webflow.io and verify login URLs before submitting credentials. PhishDestroy recommends reporting this domain to security teams and updating blocklists to prevent further exploitation. Remaining risk is high due to the domain's active status and low detection rate.