whatsapp[.]net[.]im

The domain whatsapp.net.im is currently taken offline but historical data indicates it was used for a brand‑impersonation campaign targeting WhatsApp users. DNS resolution points to the IP address 46.3.112.104, which geolocates to the United States. The domain was served without an SSL certificate, leaving traffic unencrypted and increasing the risk of credential harvesting. VirusTotal analysis recorded 16 detections out of 93 security vendors, confirming that multiple scanning engines identified malicious behavior.

Gridinsoft assigned a trust score of 0 out of 100, a rating consistent with known phishing infrastructure. The site’s HTML title was observed as "WhatsApp安全檢測中心," directly referencing the WhatsApp brand and supporting the classification of social‑media phishing. The domain appeared on a single public blocklist, PhishDestroy, indicating that at least one defensive feed has already flagged the host. AlienVault OTX reports the domain in four separate threat intelligence pulses, reinforcing its association with malicious activity.

Nameserver records list a.share-dns.com, a3.share-dns.com, b.share-dns.net, and b3.share-dns.net, which are commonly used by fast‑flipping or disposable hosting services. While the site is no longer reachable, the combination of vendor detections, a zero trust score, lack of TLS, and the presence on blocklists and OTX pulses suggests a high likelihood of credential‑stealing intent. Defenders should continue to block the domain at network perimeters, monitor for any re‑registration attempts, and ensure that endpoint protection solutions are updated to include the observed indicators of compromise. Organizations should also educate users about unsolicited WhatsApp‑related security checks and enforce multi‑factor authentication to mitigate potential credential compromise.