tesrtnewergrcdfv-4e0e886e14bb[.]herokuapp[.]com

This domain, tesrtnewergrcdfv-4e0e886e14bb.herokuapp.com, is currently classified as a high‑risk generic phishing site and remains active as of the report date, 07 August 2026. Automated scans on VirusTotal show that 16 of 91 security vendors have flagged the host, indicating a moderate consensus of malicious intent. The domain resolves to the IPv4 address 54.78.134.111, which is the sole network endpoint observed in the available data. Google Safe Browsing lists the site under the ‘social engineering’ category, reinforcing the phishing assessment.

Independent mitigation services have added the host to blocklists; PhishDestroy reports the domain as blocked, and it appears on one additional public security blocklist. The available evidence does not include details such as SSL certificate properties, HTTP response codes, page titles, or content analysis, so the exact nature of the credential‑harvesting mechanism cannot be confirmed at this time. Likewise, information about the hosting provider, ASN, or geographic location beyond the IP address is not provided. Consequently, defenders should treat the domain as hostile and assume it may be used to harvest user credentials or deliver malicious payloads.

Recommended actions are to deny any outbound connections to 54.78.134.111 at the network perimeter, add the fully qualified domain name to DNS‑based deny lists, and ensure that endpoint protection solutions incorporate the 16 vendor detections from VirusTotal. Monitoring for any traffic spikes to the domain or related sub‑domains is advised, as is reviewing logs for attempted user interactions that may have been redirected to the host. Continuous re‑evaluation should be performed, as additional intelligence such as page content or certificate details may emerge and refine the threat profile.