wompstores[.]lat

The domain wompstores.lat has been identified as a brand impersonation phishing domain, specifically targeting users of the Wompi payment platform. Currently classified as offline, this domain was designed to deceive individuals into believing they were interacting with legitimate Wompi services. The threat type is a sophisticated brand impersonation campaign aimed at credential theft, where unsuspecting users might have entered sensitive login information.

PhishDestroy's analysis reveals that wompstores.lat was flagged by 4 out of 95 VirusTotal security vendors, indicating a moderate but notable detection rate among cybersecurity tools. The domain was registered on May 20, 2026, through Spaceship, Inc., and resolved to the IP address 66.29.148.167. It appears on three security blocklists, further corroborating its malicious intent. The SSL certificate was issued by Let's Encrypt (R12), which, while legitimate, is commonly abused by phishing sites. The page title was set to "Wompi," directly mimicking the brand to lend an air of authenticity.

Given that the domain is now taken offline, the immediate risk to users is reduced, but the infrastructure may be repurposed. Users who may have interacted with wompstores.lat should change their Wompi account credentials immediately and monitor for any unauthorized transactions. It is also advisable to enable multi-factor authentication on all financial accounts. PhishDestroy recommends that organizations using Wompi educate their users about this specific threat and implement domain monitoring to detect similar impersonation attempts in the future.