lobstrrwellet[.]webflow[.]io

This domain, lobstrrwellet.webflow.io, is identified as a brand impersonation threat specifically targeting WalletConnect, a decentralized Web3 communication protocol. The threat type involves presenting a fraudulent interface mimicking the legitimate WalletConnect connection portal, likely designed to harvest cryptocurrency wallet credentials or facilitate unauthorized transactions. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented risk. Analysis indicates the domain was registered through Webflow on May 6, 2026, an unusually forward-dated creation timestamp that may reflect an attempt to evade temporal detection heuristics. It resolved to the IP address 104.18.36.248, a Cloudflare-associated endpoint commonly used for both legitimate and malicious content distribution. The domain was flagged by 6 of 95 security vendors on VirusTotal, while three independent security blocklists listed it as malicious. Additional infrastructure analysis reveals the use of Google Trust Services for SSL certification, Webflow for hosting, and Cloudflare for content delivery, with HTTP/3 protocol support detected. The Gridinsoft trust score for this domain was 0 out of 100, reinforcing its classification as high-risk. The domain is currently offline, reducing immediate exposure to end users. However, historical indicators and infrastructure reuse patterns suggest potential for reemergence. It is recommended that network administrators block the domain and associated IP at the perimeter level. Wallet service providers and decentralized application platforms should monitor for similar impersonation attempts, particularly those leveraging Webflow subdomains or Cloudflare-hosted endpoints. End users are advised to verify domain authenticity via official documentation and avoid interacting with unsolicited wallet connection prompts.