loobstrwallettu[.]webflow[.]io

Analysis of the domain loobstrwallettu.webflow.io indicates that it was used to host a crypto drainer campaign targeting users of the Lobstr wallet. The site presented the title "Lobstr Wallet Setup Guide: Step-by-Step Instructions", suggesting an attempt to lure victims with a purported guide. The domain was provisioned through Webflow and resolves to the Cloudflare address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming that HTTPS was correctly configured at the time of observation.

VirusTotal recorded 11 detections out of 91 scanning engines, indicating that multiple security products flagged the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, showing that several defensive platforms have incorporated it into their protection sets. An HTTP request returned a 404 status, and the current operational status is listed as offline, suggesting that the site has been taken down or otherwise rendered inaccessible.

Nameserver information could not be retrieved. The combination of a targeted page title, a low trust score, multiple vendor detections, and inclusion on blocklists supports a high‑risk classification. Defenders should continue to block the IP address 104.18.36.248 and the domain itself at DNS and proxy layers, monitor for any re‑hosting on alternative infrastructure, and consider updating threat‑intel feeds with the observed indicators. Because the site is no longer reachable, further content analysis is not possible, and the precise payload or credential‑harvesting mechanisms remain unknown.