lobstraewallet[.]webflow[.]io

This domain, lobstraewallet.webflow.io, operates as a crypto drainer phishing site designed to compromise digital wallet credentials and siphon cryptocurrency assets. Analysis indicates the infrastructure specifically targets users through a fraudulent interface mimicking legitimate wallet access portals, with a focus on the Tezos ecosystem as suggested by the page title. The site employs social engineering tactics, including urgency and false claims of secure access, to trick victims into entering sensitive recovery phrases or private keys. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered through Webflow on May 06, 2026, an unusual future date that may indicate tampering or obfuscation. It resolves to IP address 172.64.151.8 and is protected by Cloudflare, a common tactic to evade detection. Security vendors have flagged the domain on VirusTotal with 12 out of 95 detections, while three independent security blocklists have listed it as malicious. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting users. Technologies detected include Webflow for hosting and HTTP/3 for communication, further complicating network-based detection efforts. Users who visited lobstraewallet.webflow.io should immediately revoke any connected wallet sessions and transfer assets to a new, secure wallet. It is critical to check for unauthorized transactions on all linked accounts and monitor for signs of credential compromise. Device scans for malware are recommended, as phishing sites may deploy additional payloads. If sensitive information was entered, assume full account compromise and follow incident response protocols, including reporting the incident to relevant blockchain security teams and law enforcement. Future vigilance is advised, as crypto drainers often reuse infrastructure or domains for subsequent campaigns.