lobstr-logi[.]webflow[.]io

PhishDestroy identifies lobstr-logi.webflow.io as an active crypto drainer impersonating the Lobstr cryptocurrency wallet service through a deceptive Webflow-hosted phishing page. The domain resolves to 104.18.36.248 and leverages a legitimate Google Trust Services SSL certificate to appear credible. Security teams should treat this as a high-risk credential harvesting threat, as it mimics Lobstr’s login flow to siphon wallet credentials and digital assets. This domain was flagged with critical indicators: zero detections on VirusTotal (2/95), hosted on Webflow under a recently registered domain, and tied to IP 104.18.36.248. Registry data shows the domain was created within the last 30 days, and proactive threat intelligence sources have not yet flagged it despite its active crypto drainer operations. The absence of detections underscores the need for real-time monitoring, as traditional security tools may overlook this threat. Users who visited lobstr-logi.webflow.io should immediately revoke any permissions granted to the site, transfer remaining assets to a secure wallet, and reset account credentials using a clean device. Enable multifactor authentication on all cryptocurrency accounts and report the domain to your SOC or via PhishDestroy’s threat submission portal. Monitor transaction histories for unauthorized transfers and consider blocking the IP 104.18.36.248 at the firewall level to prevent further access.