xmgwhtsapp[.]cc

This domain, xmgwhtsapp.cc, is flagged for brand impersonation, specifically targeting the well-known messaging platform WhatsApp. The domain was designed to mimic the official WhatsApp Web page, potentially to deceive users into providing sensitive information such as login credentials or personal data. No drainer kit or additional malicious payload has been identified in the initial analysis.

Infrastructure analysis reveals that the domain resolves to the IP address 35.188.173.136, which is located in the United States and is associated with AS396982 Google LLC. The domain was created on February 21, 2026, and has an SSL certificate identified as R12. According to VirusTotal, 17 out of 95 security vendors have flagged this domain as malicious. The domain appears on one security blocklist and has been marked as unsafe by the Google Safe Browsing service.

The current status of xmgwhtsapp.cc is offline, having been taken down as part of a coordinated response to mitigate the threat. Despite this, the domain remains a potential risk if it is reactivated or if residual copies of the phishing page are still accessible. Security teams are advised to monitor for any signs of re-emergence and to ensure that users are educated on the risks of brand impersonation and the importance of verifying the authenticity of web pages before entering sensitive information.