whir[.]at

The domain whir.at was a phishing site engaged in brand impersonation, specifically targeting Facebook users. It posed an elevated risk by mimicking the Facebook brand to deceive victims into disclosing login credentials or other sensitive information. No crypto drainer kit was detected on this domain. As of the latest verification, whir.at has been taken offline.

Technical indicators confirm the malicious nature of whir.at. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Seclookup, and appeared on 1 security blocklist (PhishDestroy). The creation date was recorded as February 21, 2026, and it resolved to the IP address 172.67.222.219, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'Bitcoin mixer | Whir'. Nameservers for the domain were shane.ns.cloudflare.com and izabella.ns.cloudflare.com. Gridinsoft assigned a trust score of 35 out of 100, and the site used Cloudflare and HTTP/3 technologies.

Individuals who interacted with whir.at should take immediate safety steps. If login credentials were entered, change passwords for the affected accounts and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity and report any fraudulent transactions. To report the phishing domain, submit it to platforms like Google Safe Browsing, PhishTank, or the impersonated brand's abuse reporting channels. Victims may also file complaints with local cybercrime authorities or organizations such as the Anti-Phishing Working Group (APWG).