lofai-connect[.]pages[.]dev

This domain is currently under investigation for credential theft through WhatsApp brand impersonation. The site presents itself as an official CRM solution for WhatsApp automation, specifically targeting users seeking multichannel customer service tools. The fraudulent nature is evident through the unauthorized use of WhatsApp's branding in both the page title and content structure, designed to harvest login credentials from business users. Analysis indicates the domain lofai-connect.pages.dev was registered through Cloudflare, Inc. on April 01, 2026, with an anomalous future creation date suggesting potential domain spoofing. The site resolves to IP address 188.114.96.3, hosted in Canada under Cloudflare infrastructure. Security telemetry shows 0/95 detections on VirusTotal, though it appears on one blocklist maintained by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy while the domain remains active and unflagged by most security vendors. Mitigation requires immediate blocking of the domain and associated IP address across all network security controls. Organizations should implement additional verification for any WhatsApp-related business tools, particularly those offering automation services. Security teams are advised to monitor for credential submission attempts to this domain and conduct password resets for any accounts potentially exposed. Given the brand impersonation vector, user awareness training should emphasize verification of official WhatsApp partnerships and domain legitimacy before credential submission.