wowjak[.]lol

The domain wowjak.lol has been identified as a credential theft phishing site impersonating the WOBLOX brand. Analysis indicates that this domain was likely used to trick users into revealing their login credentials, thereby compromising their accounts and potentially leading to further malicious activities.

Infrastructure analysis reveals that the domain is registered through NameSilo, LLC, and was created on January 06, 2026. It resolves to the IP address 45.67.85.152 and uses an SSL certificate from Let's Encrypt. The domain employs Nginx as its web server. On VirusTotal, 4 out of 95 security vendors have flagged this domain, and it appears on 2 security blocklists, including PhishDestroy and ScamSniffer. The Google Safe Browsing (GSB) status is not explicitly mentioned, but its presence on multiple blocklists suggests it has been marked as unsafe.

Currently, the domain is offline, which indicates that it has been taken down or is no longer active. However, the risk remains elevated due to the potential for the domain to be reactivated or repurposed in the future. It is recommended that users who have interacted with this domain change their passwords and enable multi-factor authentication for their WOBLOX accounts. Security teams should monitor for any signs of the domain reappearing and consider adding it to internal blocklists to prevent future access.