whatsap[.]softbiznes[.]net

whatsap.softbiznes.net was registered on 21 February 2026 and is presently taken offline. DNS resolution points to the IPv4 address 85.209.70.13, which belongs to the Russian autonomous system AS21030 operated by Cluster LLC. The host location is identified as Russia. The site presented a page title of “WhatsApp,” matching the declared brand target of WhatsApp and confirming a brand‑impersonation intent. The SSL certificate in use is identified as “R12,” indicating the presence of a TLS layer but offering no indication of legitimate ownership.

Analysis by VirusTotal shows that ten of ninety‑three scanned security vendors flagged the domain as malicious, reinforcing the suspicion of malicious activity. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that at least one threat‑intelligence provider has catalogued it as hostile. The overall risk rating is elevated, reflecting the combination of recent registration, foreign hosting, brand impersonation, and partial vendor detections.

Although the site is currently offline, defenders should continue to deny any network traffic to 85.209.70.13 and to the fully qualified domain name, update DNS‑based blacklists, and monitor for any re‑appearance of the domain or similar naming patterns. Organizations that rely on WhatsApp credentials should be reminded to verify URLs against official domains and to educate users about unsolicited messages that reference WhatsApp. Ongoing observation of the hosting ASN and any future registrations under the softbiznes.net zone is recommended to detect potential campaign reuse.