whats-xtn[.]vip

The domain whats-xtn.vip was first registered on 23 October 2025 through Gname.com Pte. Ltd. and resolves to the IPv4 address 20.2.67.40, which is hosted in Hong Kong under ASN 8075 belonging to Microsoft Corporation. An SSL certificate identified as “R13” is present on the host, indicating the site employed TLS. Threat‑intel sources have classified the site as a brand‑impersonation campaign targeting WhatsApp. The infrastructure has been cited in twelve AlienVault OTX pulses, appears on one public security blocklist, and is currently blocked by the PhishDestroy feed.

VirusTotal analysis shows that seventeen of ninety‑three scanning engines flagged the domain as malicious, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The site’s operational status is listed as offline, which suggests the phishing infrastructure has been taken down or is no longer serving content. Evidence is limited to the metadata described above; no page‑level artifacts, such as page titles or HTML snapshots, have been published, leaving the exact phishing payload and delivery mechanisms unverified. Consequently, defenders should treat the domain as a confirmed malicious actor and proactively block both the fully qualified domain name and the associated IP address at network perimeters.

Continuous monitoring of the 20.2.67.40 host for any re‑activation, as well as periodic re‑query of threat‑intel feeds for new pulses or blocklist entries, is advised. Adding the registrar Gname.com Pte. Ltd. to a watchlist may help identify future domains that share the same registration profile. Organizations that employ web‑filtering or DNS‑sinkhole solutions should ensure that the domain is included in their deny lists to prevent end‑user exposure.