wzlfb[.]my

This domain, wzlfb.my, is flagged for brand_impersonation targeting the Solana cryptocurrency platform. Analysis indicates the site was designed to mimic legitimate Solana wallet interfaces, likely to harvest credentials or private keys from unsuspecting users. No specific drainer kit signatures were identified, but the presence of frontend libraries such as Bootstrap, jQuery, and Lodash suggests a dynamically generated phishing page with responsive design elements. Infrastructure analysis reveals the domain was registered on August 16, 2025, through Dynadot LLC and currently resolves to the IP address 23.225.199.94. Security vendor detections on VirusTotal stand at 11/95, indicating moderate confidence in malicious classification. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature. Additional technologies detected include Caddy as the web server, Swiper for touch sliders, and HTTP Strict Transport Security (HSTS) enforcement. As of the latest assessment, wzlfb.my has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed. Historical DNS records and SSL certificates may persist in caches, posing residual risks. Organizations are advised to monitor for recurring resolutions of this domain or similar patterns in newly registered domains under the same registrar. Users who interacted with the site should revoke any permissions granted to associated wallet addresses and audit connected accounts for unauthorized transactions.