heritagesroyals[.]com

This domain, heritagesroyals.com, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Currently offline, the domain was operational until recently, posing an elevated risk to individuals and organizations by attempting to capture sensitive authentication credentials. No specific brand impersonation has been confirmed, but the infrastructure and page structure align with generic phishing campaigns designed to mimic legitimate services. Analysis indicates the domain was registered through NameSilo, LLC on January 31, 2025, and resolved to the IP address 198.12.80.250, hosted by AS36352 (HostPapa) in the United States. The site employed a Let's Encrypt SSL certificate (R12) to create a false sense of security. At the time of assessment, the domain was flagged by 9 of 95 security vendors on VirusTotal and appeared on one security blocklist. The page title, 'Index of /,' suggests an exposed directory listing, which is atypical for legitimate services and often indicative of misconfigured or malicious infrastructure. The domain has since been taken offline, reducing immediate risk to users. However, infrastructure analysis reveals patterns consistent with phishing operations, including the use of low-cost registrars and hosting providers commonly exploited for malicious purposes. Organizations and individuals are advised to block the domain and associated IP (198.12.80.250) at the network level. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where possible. Proactive threat hunting for similar directory listing patterns or Let's Encrypt certificates issued to newly registered domains is recommended to identify emerging threats.