whats-xts[.]vip

This domain, whats-xts.vip, was registered on February 21, 2026 through Gname.com Pte. Ltd. and subsequently resolved to the IP address 20.2.67.40, which belongs to Microsoft Azure’s East Asia region in Hong Kong. The infrastructure is hosted on Azure cloud services, a common platform for both legitimate and malicious actors. The domain appears in one public security blocklist and has been explicitly blocked by the PhishDestroy service. Google Safe Browsing classifies the site as a social‑engineering threat, and AlienVault OTX references the domain in thirteen independent threat‑intel pulses, indicating recurring observation across multiple feeds.

VirusTotal analysis shows that 17 out of 93 scanned security engines have flagged the domain, reinforcing the suspicion of malicious use. The authoritative name servers are a9.share-dns.com and b9.share-dns.net, both of which are frequently employed by fast‑flux and disposable domains. The current operational status is reported as offline, suggesting the site has been taken down or is temporarily inaccessible.

However, the presence of the domain on blocklists, the Google Safe Browsing flag, and the multiple vendor detections demonstrate a high likelihood that the domain was used for generic phishing attempts. Defenders should continue to block the domain at DNS and firewall layers, monitor the associated IP address for any re‑use, and consider adding the nameservers to threat‑intel feeds. Ongoing collection of any host‑level artifacts or URL redirects, if the site reappears, will be essential for confirming the exact phishing payload and target brand.