vvv-wahst5pp[.]com

The domain vvv-wahst5pp.com was registered on February 21, 2026 through GKG.Net, Inc. and is configured to use the authoritative nameservers n1.xundns.com and n2.xundns.com. DNS resolution points to the IP address 103.80.133.43, which belongs to AS205960 HDTIDC LIMITED and is geolocated in the Republic of Korea. The site presented an SSL certificate issued by Let’s Encrypt (R12), indicating that HTTPS was available at the time of observation. The HTTP response header identified the web server as Apache HTTP Server, and the page contained Baidu Analytics tracking code. The page title retrieved from the site reads "whatsapp官网登录入口| 发送文件的最佳格式：确保顺畅传输," directly referencing WhatsApp and suggesting a login portal.

This title, together with the documented brand target of WhatsApp, confirms the infrastructure was designed to impersonate the messaging service. Malware and URL reputation services have taken notice: VirusTotal recorded detections from 16 of 93 scanning engines, and the domain appears on one public security blocklist. It has also been referenced in thirteen AlienVault OTX threat pulses, indicating that the indicator has been shared among multiple threat‑intel communities. The site was subsequently taken offline and is currently listed as blocked by PhishDestroy.

Although the domain is no longer active, defenders should continue to monitor for any re‑registration or resurgence of the same infrastructure, especially given the elevated risk rating. Network defenders are advised to add the IP 103.80.133.43 and the domain vvv-wahst5pp.com to deny‑list policies, ensure that endpoint protection solutions surface the Let’s Encrypt certificate fingerprint, and audit any outbound connections to the Korean hosting ASN. Because the site employed a legitimate SSL certificate and common web technologies, automated filters may miss it; therefore, security teams should incorporate the observed page title and the Baidu Analytics indicator into content‑inspection rules.