lobsttrwalletiis[.]webflow[.]io

Analysis of lobsttrwalletiis.webflow.io indicates a high‑risk crypto drainer campaign. The site is hosted on Webflow, a legitimate SaaS platform, and resolves to the Cloudflare edge address 104.18.36.248, which is announced as part of AS13335 Cloudflare, Inc. The IP is geo‑located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of a valid HTTPS certificate. The page title returned by the server is “Lobstr Wallet Security: Safeguard Your Stellar (XLM) Investments”, which suggests an attempt to impersonate the Lobstr wallet service and target users of the Stellar (XLM) cryptocurrency. VirusTotal records show that 13 of 91 scanning engines flagged the domain as malicious, and three independent blocklists currently list the domain.

Defensive products such as PhishDestroy, MetaMask, and SEAL have already blocked the domain. The HTTP response is a 404 status, and the domain’s nameserver information is unavailable (NS_NOT_FOUND). Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The operational status is reported as offline, indicating that the campaign may have been taken down or is temporarily inactive.

Uncertainties remain regarding the exact payload or malicious code delivered, as the site returned only a 404 page and no additional content was captured. The lack of visible content prevents verification of any credential‑harvesting forms or wallet‑draining scripts. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for traffic to the associated Cloudflare IP, and update detection signatures with the observed VirusTotal and blocklist identifiers.