for-your-success-whatsapp[.]herokuapp[.]com

Analysis of for-your-success-whatsapp.herokuapp.com shows an active credential‑phishing infrastructure. The domain was registered on July 08 2026 through Salesforce.com, Inc., and resolves to IP 18.208.60.216, an AWS EC2 instance in the US East‑1 region. The site serves HTTP 200 responses and presents a TLS certificate issued by Amazon (RSA 2048 M01). Page metadata reports a title of "WhatsApp" and the front‑end stack includes Node.js, Express, Bootstrap, Socket.io, jQuery, Google Hosted Libraries, and Popper, indicating a typical Heroku‑hosted web application. VirusTotal records 12 of 91 security vendors flagging the domain, and it appears on a single security blocklist. The domain is currently blocked by PhishDestroy, and Gridinsoft assigns a trust score of 0 / 100, reinforcing its malicious classification. Risk is rated high. No nameserver information is available, and the exact page content has not been inspected, leaving details of the credential‑capture mechanism uncertain. Defenders should immediately block outbound and inbound traffic to this domain and its resolved IP, add it to internal blocklists, and consider sinkholing the IP range. Continuous monitoring of DNS queries for the domain and related subdomains is advised, as well as reviewing any authentication logs for attempted credential submissions that may have been directed to this host.