ail-rosenheim-marion-knauf-bc9143473673[.]herokuapp[.]com

This domain, ail-rosenheim-marion-knauf-bc9143473673.herokuapp.com, is currently active and identified as a high-risk generic phishing threat. Analysis indicates the site impersonates the WhatsApp brand, as evidenced by the page title and content structure. The campaign appears designed to harvest user credentials through a fraudulent login interface, a common tactic in brand impersonation phishing operations. Infrastructure analysis reveals the domain resolves to the IP address 3.216.88.24 and is registered through Salesforce.com, Inc. Detection metrics show the domain is flagged by 10 of 95 security vendors on VirusTotal, indicating moderate but concerning consensus among threat intelligence providers. The SSL certificate is issued by Amazon, a detail consistent with legitimate cloud-hosted services but frequently exploited by threat actors to lend false credibility. No historical registration data or creation date is publicly available for this subdomain, suggesting it may have been recently deployed or obfuscated through a cloud platform. The domain remains active as of this report, posing an ongoing risk to users who may encounter it through phishing links distributed via email, social media, or messaging platforms. Organizations and individuals are advised to block the domain and its resolving IP at the network level. End-users should be alerted to verify the authenticity of any WhatsApp-branded login pages, particularly those hosted on non-official domains. Security teams are recommended to monitor for additional subdomains or IPs associated with this infrastructure, as threat actors often rotate hosting to evade detection.