whatsaptasohbettt[.]netlify[.]app

The domain whataptasohbettt.netlify.app is flagged as a generic phishing threat. The page title 'WhatsApp' suggests an attempt to mimic the legitimate WhatsApp platform, likely to deceive users into providing sensitive information. No specific drainer kit has been identified, but the domain's appearance on one security blocklist and its high risk level indicate a significant threat.

Infrastructure analysis reveals that the domain resolves to the IP address 63.176.8.218, which is located in Germany (DE) on an AWS EC2 (eu-central-1) server. The domain is registered through Netlify. The SSL certificate is issued by DigiCert Inc, specifically under the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The VirusTotal (VT) score is 7/95, indicating that while the majority of security vendors have not flagged it, a notable number have identified it as a threat. The domain appears on 1 known security blocklist and is listed in the Google Safe Browsing (GSB) database, further confirming its malicious nature.

Currently, the domain remains active, posing a high risk to users who may be deceived by its mimicry of the WhatsApp brand. Response actions should include blocking the domain at the network level to prevent access and alerting potential victims to the threat. Given its ongoing activity and the fact that it is still accessible, there is a significant remaining risk, and continuous monitoring and updates to security measures are recommended.