hotelproorlandotrial-whatsapp[.]herokuapp[.]com

This domain, hotelproorlandotrial-whatsapp.herokuapp.com, is actively engaged in brand impersonation targeting WhatsApp, a widely used messaging platform. The site presents itself as an official WhatsApp portal, as evidenced by its page title and design elements, with the intent to deceive users into disclosing sensitive credentials or installing malicious payloads. Analysis confirms the domain remains operational as of the latest verification, posing a persistent risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on September 19, 2010, through Salesforce.com, Inc., and is hosted on an IP address (18.208.60.216) associated with Amazon.com, Inc. (AS14618) in the United States. Security vendors have flagged this domain as malicious, with 20 out of 95 VirusTotal engines detecting it as phishing-related. Additionally, the domain appears on two independent security blocklists, PhishDestroy and PhishingDB, and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate is issued by Amazon RSA 2048 M01, a common provider for both legitimate and malicious infrastructure, which does not mitigate the domain's fraudulent nature. The current risk level is assessed as high due to the domain's active status, brand impersonation tactics, and consistent detection by security mechanisms. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include its IP address and associated indicators. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the session and monitor for unauthorized activity. Security teams are encouraged to review logs for connections to 18.208.60.216 and correlate with other phishing campaigns impersonating communication platforms.