lobstertoken[.]top

The domain lobstertoken.top was registered on February 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the Cloudflare‑owned address 188.114.96.3, located in the United States and announced by ASN 13335. The domain is served by the Cloudflare nameservers audrey.ns.cloudflare.com and rohin.ns.cloudflare.com, confirming that the attacker is leveraging Cloudflare’s CDN and DDoS protection services.
When accessed, the site returns HTTP status 403 and presents a minimal page titled “Just a moment…”. The TLS certificate is issued by Let’s Encrypt (certificate identifier E7), and the connection negotiates HTTP/3, indicating modern protocol support. The domain appears on three public blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records a single vendor detection out of 95, while Gridinsoft assigns a trust score of 0/100, reflecting a high confidence of malicious intent.
Current analysis cannot reveal the final phishing payload because the Cloudflare challenge page prevents direct content inspection. No malware hash, credential‑stealing form, or redirect URL has been observed, leaving the exact credential‑harvesting method uncertain. However, the explicit impersonation of the OKX cryptocurrency exchange suggests the operator’s objective is to lure users into submitting wallet credentials or two‑factor authentication codes.
Defenders should add lobstertoken.top to DNS‑level blocklists and enforce network‑level filtering of traffic to 188.114.96.3. Monitoring for repeated HTTPS requests with the “Just a moment…” response can help identify infection attempts. User awareness campaigns must emphasize verification of OKX URLs and discourage entry of credentials on unknown pages. Continuous re‑evaluation of threat intel feeds is advised, as the infrastructure may evolve or spawn additional domains.