ahrariraq[.]com

This domain, ahrariraq.com, was actively used to distribute fake WhatsApp group invitations designed to harvest user credentials or install malicious software. Visitors were presented with a fabricated invitation page, often prompting them to enter personal information or download harmful files under the guise of joining a legitimate group. The threat primarily targets users seeking to connect with communities, exploiting trust in the WhatsApp brand to facilitate unauthorized access to accounts or devices. Analysis indicates the domain was created on August 3, 2025, and registered through GoDaddy.com, LLC. It resolved to the IP address 104.21.50.26, hosted on Cloudflare infrastructure (AS13335), which is commonly used to obscure malicious activity. The site was flagged by 17 out of 95 security vendors on VirusTotal, and it appeared on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Google Trust Services, further masked its malicious intent by presenting a seemingly secure connection. If you visited ahrariraq.com or interacted with its content, immediate action is required. Disconnect the affected device from the internet to prevent potential data exfiltration. Run a full antivirus scan to detect and remove any installed malware. Change passwords for all accounts accessed from the device, particularly those linked to messaging platforms or financial services. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. Report the incident to your organization's security team or a trusted cybersecurity professional for further assistance.