lobstr-walleetn[.]webflow[.]io

PhishDestroy identifies lobstr-walleetn.webflow.io as an active phishing domain impersonating a digital wallet service to harvest user credentials and cryptocurrency assets. This domain uses Webflow’s hosting infrastructure to deliver a fraudulent interface that closely mimics legitimate wallet login pages, specifically targeting users of the Lobstr wallet platform. The threat is classified as elevated due to the combination of social engineering content, active hosting, and the use of a trusted third-party publishing platform to obscure malicious intent. Threat actors leverage this domain to trick users into entering sensitive login information or transferring funds under false pretenses, representing a direct financial risk to cryptocurrency users.

This domain was flagged by PhishDestroy’s automated crawlers and has been confirmed through multiple technical indicators. It resolves to IP address 104.18.36.248 and is served via a Google Trust Services SSL certificate, which may help it evade basic browser warnings. VirusTotal analysis shows 4 out of 95 security vendors have detected malicious activity associated with this domain as of the latest scan. While the exact domain registration date is not publicly available through standard WHOIS queries, the active status and recent flagging indicate ongoing deployment. The domain is not currently listed on major blocklists such as Google Safe Browsing, PhishTank, or OpenPhish, which may contribute to its continued operation. Despite the use of a legitimate SSL certificate, the behavior of the site—mimicking a wallet interface without direct affiliation to the legitimate service—clearly indicates malicious intent.

Given the specific threat posed by this fake wallet phishing site, users are strongly advised to verify all web addresses before entering credentials or making transactions. Always access wallet services through official domains (e.g., lobstr.app) or verified mobile applications. Implement browser-based protections and consider using domain reputation tools or browser extensions that flag suspicious sites. If you have interacted with this domain, immediately change your wallet password, revoke any active sessions, and transfer assets to a secure wallet if compromised. Report this phishing attempt to your wallet provider and relevant cybersecurity authorities such as the Anti-Phishing Working Group (APWG) or local CERT teams to aid in global takedown efforts.