lobstrwlletlogin[.]godaddysites[.]com

PhishDestroy identifies lobstrwlletlogin.godaddysites.com as an active credential theft domain masquerading as the legitimate Lobstr wallet login portal. The threat level is currently marked as under_investigation due to the sophisticated impersonation tactics and low detection rates, but initial indicators strongly suggest active exploitation. This domain was flagged with 0 detections out of 95 VirusTotal engines, raising concerns given its high-risk purpose. It resolves to IP 13.248.243.5 and operates under GoDaddy Sites hosting, secured by a GoDaddy SSL certificate. Registered in November 2013, this long-standing but misused domain appears to have been repurposed for malicious hosting, likely leveraging GoDaddy’s reputation to evade detection. No current blocklist entries were observed at the time of analysis, and trust scores remain neutral due to the domain’s age and legitimate-looking infrastructure. Organizations should immediately block traffic to 13.248.243.5 and lobstrwlletlogin.godaddysites.com at the network perimeter and DNS levels. Users must be warned not to access this domain or enter any credentials, as it is designed to harvest login information for cryptocurrency wallet services. Security teams should inspect historical logs for any interaction with this IP or domain and consider it a high-priority threat until further intelligence confirms resolution or takedown.