llobstrdwallet[.]webflow[.]io

llobstrdwallet.webflow.io is a subdomain of webflow.io. PhishDestroy first recorded this hostname on Jun 18, 2026. The stored content classification is generic phishing. The assembled evidence scores 76/100 (high).

Three independent sources are positive: VirusTotal, MetaMask, and SEAL. VirusTotal recorded 7 detections among 91 engines: ChainPatrol, alphaMountain.ai, Emsisoft, Fortinet, LevelBlue, Netcraft, Webroot on Jul 18, 2026 at 18:45 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. The evidence is not unanimous. Google Safe Browsing returned no flag on Jun 18, 2026 at 16:30 UTC. URLScan completed without a malicious verdict (score 0) on Jun 25, 2026 at 08:19 UTC.

HTTP 404 was recorded on Aug 7, 2026 at 01:04 UTC; content was unavailable. Registration records for the registrable domain webflow.io list Webflow as the registrar. At collection time, the hostname resolved to 172.64.151.8 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. The stored server header is cloudflare. Captured page title: “Lobstr ® *%wallet | Lobstr® wallet”. DOM analysis completed on Jun 18, 2026 at 18:20 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 1, 2026 at 04:05 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Google Trust Services / WE1 as the certificate issuer with validity through Aug 25, 2026; checked Jun 18, 2026 at 19:00 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as generic phishing.