whats-zvh[.]vip

Analysis of whats-zvh.vip indicates a confirmed brand impersonation campaign targeting WhatsApp users, with elevated risk due to observable infrastructure and detection patterns. The domain, registered on October 5, 2025, through Gname.com Pte. Ltd., currently resolves to IP address 20.2.67.40, hosted on Microsoft Corporation's AS8075 infrastructure in Hong Kong. No SSL certificate was detected, increasing susceptibility to interception or tampering during transmission. Infrastructure analysis reveals the domain uses nameservers a.share-dns.com, a10.share-dns.com, b.share-dns.net, and b10.share-dns.net, a configuration commonly associated with low-cost or bulletproof hosting environments.

Detection data shows the domain appears on one security blocklist and is flagged by 15 of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. AlienVault OTX records further corroborate this, with the domain listed in 17 threat intelligence pulses, suggesting active tracking by security researchers. The domain's current status is offline, though this does not eliminate residual risk, as phishing campaigns often cycle through multiple domains or reactivate infrastructure. Gridinsoft's trust score of 0/100 aligns with the observed detection patterns, reinforcing the classification as a high-confidence phishing domain.

Defenders should treat this domain as compromised and block it at the DNS and network levels. Organizations targeting WhatsApp users should monitor for similar domain registrations (e.g., typosquatting, brand + random suffix patterns) and implement proactive detection rules to prevent future impersonation attempts. No page content analysis is available, so the exact phishing mechanism remains unconfirmed, though the brand target and detection context strongly suggest credential harvesting or social engineering tactics.