connect-whiterockpay[.]pro

This domain presents an elevated risk as a targeted brand phishing attack impersonating Whiterockpay, a legitimate payment platform. The threat is specific: attackers registered connect-whiterockpay.pro to harvest login credentials or financial data from unsuspecting users who believe they are interacting with the real Whiterockpay service. Although the domain is now offline, the infrastructure used may be repurposed for similar campaigns.

PhishDestroy's investigation reveals several red flags. VirusTotal shows 5 out of 95 security vendors flagging this domain, indicating moderate but clear malicious consensus. The domain was created on February 21, 2026, making it very recent at the time of detection. It was registered through NiceNIC International Group Co., Limited, a registrar often associated with low-cost, anonymous registrations. The domain resolved to IP address 104.21.41.115, which is linked to Cloudflare, potentially used to obscure the true hosting location. The SSL certificate was issued by Google Trust Services (WE1), providing a false sense of security. The domain appears on 4 security blocklists, further confirming its malicious intent. The page title was exactly "Whiterockpay," mimicking the brand to deceive visitors.

Users who may have encountered this domain should immediately change their Whiterockpay passwords and enable two-factor authentication if not already active. Monitor accounts for unauthorized transactions and report any suspicious activity to Whiterockpay's security team. Avoid clicking links in unsolicited emails or messages claiming to be from Whiterockpay; always navigate directly to the official website. PhishDestroy recommends using a password manager and staying informed about common phishing tactics to reduce risk.