wellrowcapital[.]com

The domain wellrowcapital.com is a confirmed phishing site engaged in brand impersonation, specifically targeting users of the cryptocurrency platform Compound. This site was designed to deceive victims into believing they were interacting with a legitimate financial service, potentially leading to unauthorized access to accounts or financial loss. As of the latest verification, wellrowcapital.com has been taken offline, though it previously operated as an active phishing threat.

Technical analysis reveals that wellrowcapital.com was flagged by 3 of 95 security vendors on VirusTotal, including ADMINUSLabs, Fortinet, and Netcraft. The domain was registered through Atak Domain on January 26, 2024, and resolved to the IP address 86.107.77.165, hosted in Germany under AS216395 (HostBet Cloud Technologies Private Limited). It appeared on one security blocklist, PhishDestroy, and had no SSL certificate. The observed page title was 'Wellrow Capital,' and the domain used nameservers ns1.hostmane.net and ns2.hostmane.net. Gridinsoft assigned it a trust score of 0/100, further indicating its malicious nature.

Individuals who interacted with wellrowcapital.com should immediately change any passwords or credentials used on the site, particularly those associated with Compound or other financial services. Enable two-factor authentication (2FA) on all accounts to prevent unauthorized access. If cryptocurrency transactions were attempted, revoke any token approvals and monitor wallet activity for suspicious transactions. Report the domain to relevant platforms, including Google Safe Browsing, PhishTank, or local cybersecurity authorities, to assist in broader mitigation efforts.