lobstrvalletu[.]webflow[.]io

This domain, lobstrvalletu.webflow.io, operates as a high-risk phishing site designed to impersonate Lobstr Wallet, a cryptocurrency wallet service. The threat type is classified as generic phishing with a specific focus on credential harvesting and unauthorized asset transfer. As of the latest analysis, the domain has been taken offline, though prior activity remains documented in security databases. Analysis indicates the domain was flagged by 13 of 95 security vendors on VirusTotal, reflecting broad detection across multiple threat intelligence platforms. It appears on three distinct security blocklists and is actively blocked by cryptocurrency security tools and browser-based phishing protection systems. The domain was registered through MarkMonitor, Inc., a registrar commonly associated with legitimate enterprises, yet in this case, leveraged for malicious purposes. Infrastructure analysis reveals the domain resolved to the IP address 172.64.151.8, a host associated with content delivery networks, which may have facilitated rapid deployment and evasion of traditional detection methods. The creation date of May 8, 2013, pertains to the parent domain, while the subdomain itself exhibits characteristics of recent malicious activity. Additional indicators include a Gridinsoft trust score of 0/100 and an SSL certificate issued by Google Trust Services, which may have contributed to the appearance of legitimacy. The domain is currently offline, reducing immediate risk to end users. However, historical data and infrastructure reuse patterns suggest potential for reactivation or migration to alternative hosts. Users who interacted with this domain are advised to immediately revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address. Security teams are recommended to conduct retrospective analysis of network logs for connections to 172.64.151.8 and review registrar records for related malicious subdomains. Proactive monitoring of content delivery networks for similar phishing infrastructure is advised to mitigate future threats.