whats-xws[.]vip

Analysis of whats-xws.vip indicates a confirmed brand impersonation phishing domain targeting WhatsApp users. The domain, registered on October 11, 2025, through Gname.com Pte. Ltd., was taken offline prior to this report but previously resolved to IP 20.255.49.229, hosted on Microsoft Corporation infrastructure (AS8075) in Hong Kong. Infrastructure review shows the domain used nameservers a.share-dns.com, a1.share-dns.com, b.share-dns.net, and b1.share-dns.net, a configuration commonly associated with low-cost or bulletproof hosting providers. Detection data reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, though the specific detection rules or payloads are not detailed in available intelligence. AlienVault OTX recorded the domain in 16 threat intelligence pulses, suggesting active tracking by security researchers.

The domain appears on at least one security blocklist, and PhishDestroy has implemented blocking measures. No SSL certificate was present, increasing the likelihood of interception or man-in-the-middle attacks during active campaigns. The domain’s creation date, eight months prior to this report, aligns with typical phishing domain lifecycles, where domains are registered in advance of deployment. The absence of an SSL certificate and the use of shared DNS providers further reduce operational costs while maintaining anonymity.

While the exact content of the phishing page is not analyzed, the domain name and brand target strongly indicate an attempt to harvest WhatsApp credentials or distribute malicious payloads under the guise of official messaging services. Defenders should treat this domain as compromised and block it at DNS, proxy, and endpoint levels. Network logs should be reviewed for connections to 20.255.49.229 or the listed nameservers, particularly from devices accessing WhatsApp or related services.