waf4[.]shop

This domain, waf4.shop, is flagged as a credential harvesting phishing site targeting users through a fraudulent electronic storefront. The site masquerades as a legitimate online retailer offering electronic devices at low prices, a common tactic to lure victims into entering sensitive login credentials, payment details, or personal information. Analysis of the page title, "عالم وافي - متجر إلكتروني | أفضل الأجهزة الإلكترونية بأقل الأسعار," indicates the site specifically targets Arabic-speaking users, increasing the risk for regional individuals or businesses interacting with e-commerce platforms. Infrastructure analysis reveals the domain was registered through Name.com, Inc. and previously resolved to the IP address 187.77.64.30. Detection metrics from VirusTotal indicate that 4 out of 95 security vendors have flagged this domain as malicious, while it also appears on one additional security blocklist. The site employed LiteSpeed and HTTP/3 technologies, which are legitimate but often leveraged in phishing campaigns due to their performance and low-cost hosting capabilities. The domain is currently offline, though this status may change, and historical activity remains a concern for retrospective threat analysis. Users who visited waf4.shop or interacted with its content should assume potential exposure of credentials or financial data. Immediate steps include resetting passwords for any accounts accessed while the site was active, particularly those tied to email, banking, or e-commerce services. Enable multi-factor authentication (MFA) on critical accounts to mitigate unauthorized access. Monitor financial statements for unauthorized transactions and report any suspicious activity to relevant institutions. If corporate devices or networks were exposed, initiate an internal review to assess potential lateral movement or data exfiltration risks. Retain logs and timestamps of interactions with the domain for forensic analysis if needed.