r43-b1aae8a08168[.]herokuapp[.]com

Analysis of r43-b1aae8a08168.herokuapp.com indicates that the domain is actively used for malicious social engineering. Google Safe Browsing classifies the site as a social engineering threat, and the domain is listed on a public blocklist maintained by PhishDestroy. VirusTotal has recorded detections from ten out of ninety-one scanned security vendors, confirming that multiple independent scanners have identified malicious activity associated with the host. The domain resolves to the IP address 3.216.88.24, which is the sole hosting endpoint observed during the investigation.

Registration information shows the domain was provisioned through Salesforce.com, Inc., but no authoritative name server records are publicly available, limiting further DNS‑level attribution. The domain appears on one additional security blocklist, reinforcing its reputation as a high‑risk resource. Current monitoring shows the site remains online and reachable, confirming its active status as of the report date, August 06, 2026.

Defenders should block both the domain and its associated IP at perimeter defenses, update URL filtering and DNS sinkhole lists, and monitor for any related traffic patterns. Incident response teams encountering emails or messages that reference this domain should treat any credential or personal data submission as compromised and advise users to reset affected accounts. Continuous re‑scanning is advised, as additional security vendors may flag new indicators over time.