wsys[.]lzysbd[.]top

On 23 July 2026 analysts recorded the domain wsys.lzysbd.top as part of a brand‑impersonation operation aimed at the WhatsApp service. The domain was created on 21 February 2026 and resolves to the IPv4 address 179.61.182.24, which is hosted in Hong Kong under autonomous system AS153656 owned by OWGELS INTERNATIONAL CO., LIMITED. The site presents an SSL certificate classified as R12, a rating that indicates a low‑trust certificate. The HTTP response includes a page title of "WhatsApp", directly matching the declared brand target and confirming the impersonation intent.

Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and 21 of 95 VirusTotal scanners label the domain as malicious. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy mitigation service. No additional technical artifacts such as login form screenshots, redirect chains, or payload samples have been published, so the precise phishing technique (credential harvest, malicious download, or redirection) remains uncertain. Nevertheless, the convergence of a brand‑targeted title, a weak SSL certificate, multiple vendor detections, and a zero‑trust score strongly suggests a high probability of credential‑stealing activity.

Defenders should immediately add wsys.lzysbd.top to DNS and proxy deny lists, monitor outbound traffic to the associated IP address, and enforce user‑education messages warning against unsolicited WhatsApp login requests. Continuous re‑evaluation on multi‑engine scanners is advised to detect any changes in hosting or payload. Although the site is currently offline, any residual connections should be examined for potential data exfiltration that may have occurred prior to takedown.