whats4pp[.]vip

Analysis of the domain whats4pp.vip confirms its classification as a phishing site with elevated risk, now offline as of July 23, 2026. The domain was registered on October 7, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious infrastructure. Infrastructure analysis reveals Cloudflare nameservers (lee.ns.cloudflare.com and mallory.ns.cloudflare.com) and resolution to the IPv6 address 2606:4700:3035::6815:5111, hosted on AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data. Detection metrics indicate moderate but consistent flagging by security vendors.

VirusTotal reports 17 of 95 security vendors marking the domain as malicious, while AlienVault OTX includes it in five threat intelligence pulses. The domain appears on at least one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The page title, 'Welcome,' offers no specific brand targeting insights, and no additional content analysis is available to determine the exact phishing lure or intended victim profile. Defenders should treat this domain as confirmed malicious infrastructure.

Given its registration date and detection history, it is likely part of a broader campaign targeting users of messaging platforms, though the exact impersonated service remains unconfirmed. Network-level blocking of the domain and associated IP (2606:4700:3035::6815:5111) is recommended. Organizations should monitor for related domains registered through Gname.com Pte. Ltd. or utilizing Cloudflare nameservers, as these may indicate additional phishing infrastructure. No evidence suggests this domain is part of a larger, named phishing kit or actor group at this time.