claim-lobstarwilde[.]com

Analysis of claim-lobstarwilde.com shows a confirmed crypto‑drainer infrastructure that is currently offline. The domain was registered on March 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and points to the Cloudflare address 172.67.150.117, which resolves to a Cloudflare, Inc. node in Canada. Both authoritative nameservers are Cloudflare‑provided (josh.ns.cloudflare.com and kay.ns.cloudflare.com). No TLS certificate is presented, indicating the site operates without HTTPS protection.

The observed page title, "LOBSTAR Airdrop 🦞 Claim Your $LOBSTAR," matches the known Airdrop Scam phishing kit, a common weapon for fake cryptocurrency airdrop lures. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—demonstrating broad detection by anti‑phishing services. VirusTotal reports that one of ninety‑four security vendors flagged the domain, reinforcing its malicious classification. The site’s technology fingerprint includes Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support, all typical of hosted phishing pages.

While the infrastructure is presently taken offline, the combination of a zero‑trust score, blocklist listings, a matching page title, and a known airdrop kit provides strong evidence that the domain was used to solicit cryptocurrency wallets under the pretense of a LOBSTAR token airdrop. Uncertainty remains regarding any additional payloads or post‑exploitation activity, as no malware or download vectors have been observed. Defenders should continue to block the domain at perimeter controls, monitor for re‑use of the associated IP address or Cloudflare nameservers, and update endpoint and web‑gateway signatures to reflect the observed page title and kit characteristics. Ongoing threat‑intel feeds should be consulted for any resurgence, and any user reports of unsolicited LOBSTAR airdrop messages should be treated as phishing attempts.