lobstrs-walliet[.]webflow[.]io

This domain, lobstrs-walliet.webflow.io, is flagged as a generic phishing site targeting users of the Lobstr Wallet cryptocurrency service. Analysis indicates the domain was designed to mimic the legitimate Lobstr Wallet interface, likely to harvest user credentials, private keys, or seed phrases. The page title explicitly displays 'Lobstr Wallet,' reinforcing the impersonation attempt. No specific drainer kit signatures were identified in the initial scan, but the domain aligns with common phishing infrastructure patterns used in cryptocurrency theft campaigns. Infrastructure analysis reveals several critical technical indicators. The domain was registered on May 15, 2026, through Webflow, an unusual creation date that may indicate an attempt to evade detection or exploit registrar policies. It resolves to the IP address 104.18.36.248, which is associated with Cloudflare’s content delivery network, a common obfuscation tactic used by threat actors. The domain is secured with an SSL certificate issued by Google Trust Services, providing a false sense of legitimacy. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. Additionally, the domain is actively blocked by multiple cryptocurrency security tools, further confirming its fraudulent nature. As of the latest assessment, lobstrs-walliet.webflow.io has been taken offline, likely in response to security vendor reports and blocklist inclusion. However, the residual risk remains elevated due to the domain’s recent activity and the potential for threat actors to redeploy the phishing infrastructure under a different domain or IP address. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and conduct retrospective log analysis to identify any prior exposure.