whatsapp-clone-frontend-liart[.]vercel[.]app

The domain whatsapp-clone-frontend-liart.vercel.app has been identified as a confirmed brand impersonation site targeting the messaging platform WhatsApp. This domain is actively used to deceive users into believing they are interacting with the legitimate WhatsApp service, which raises significant security concerns. The threat is categorized as high risk due to its potential to facilitate phishing attempts and collect sensitive user information through deceptive practices.

Technical analysis reveals that the domain is currently listed on two security blocklists, and it has a VirusTotal detection score of 23 out of 95 security vendors, indicating significant scrutiny from the cybersecurity community. The domain is registered through Vercel Inc. and resolves to the IP address 64.29.17.67, which is located in the United States and associated with Amazon.com, Inc. The domain has been flagged by security platforms PhishDestroy and PhishingDB, confirming its malicious intent and active status.

As of the current assessment, the domain remains active and poses an ongoing risk to users who may unknowingly interact with it. Response actions should include continued monitoring of the domain on security blocklists and increased awareness campaigns to inform users about the risks associated with this domain. It is advisable for users to exercise caution and verify the authenticity of any communications claiming to be from WhatsApp, particularly those that direct them to unfamiliar URLs. The domain's active status and its ability to bypass certain security measures underscore the importance of vigilance against brand impersonation threats.