whatspp[.]online

The domain whatspp.online was registered on 27 June 2026 through the registrar REGISTER S.P.A. and currently resolves to the IP address 216.239.32.21, served by the nameservers ns1.amenworld.com and ns2.amenworld.com. As of the report date, 1 August 2026, the domain is listed on two independent phishing blocklists, PhishDestroy and OpenPhish, indicating that it has been observed in active phishing campaigns. VirusTotal analysis shows that 13 of 91 security vendors have flagged the domain as malicious, reinforcing the blocklist evidence.

The domain remains active, and its risk level is classified as high. No additional public intelligence such as SSL certificate details, HTTP response codes, or page titles has been disclosed, limiting the depth of technical fingerprinting. The combination of recent registration, presence on reputable blocklists, and multi‑vendor detection suggests a purpose‑built infrastructure for credential harvesting or related fraudulent activity.

Defenders should continue to block the domain at network perimeters, update endpoint protection signatures to include the observed detection count, and monitor DNS queries for the associated IP and nameserver pair. Threat hunters may also query the registrar for any further registration changes and consider sinkholing the IP address if operationally feasible. Continuous re‑evaluation is advisable, as additional indicators such as content analysis or SSL information may emerge in subsequent investigations.