whats-zni[.]vip

This domain is flagged for elevated risk due to brand impersonation phishing targeting WhatsApp, a widely used messaging platform. The threat involves fraudulent replication of WhatsApp branding to deceive users into disclosing credentials, personal data, or installing malicious payloads. Analysis indicates the domain was specifically designed to exploit trust in the WhatsApp brand, a common tactic in credential harvesting and social engineering campaigns. Infrastructure analysis reveals the domain whats-zni.vip was registered on February 21, 2026, and resolves to the IP address 20.255.49.229, hosted under AS8075 (Microsoft Corporation) in Hong Kong. The SSL certificate is identified as R12, a detail that may assist in tracking related infrastructure. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. The domain appears on two security blocklists and is actively blocked by at least two threat intelligence feeds. No legitimate association with WhatsApp or its parent organization has been verified. Mitigation steps for this specific threat type include immediate domain blocking at the DNS or network perimeter level to prevent user access. Security teams should monitor for any attempts to access this domain from internal networks, as such activity may indicate compromised endpoints or targeted phishing attempts. End-user education should emphasize verifying domain authenticity before entering credentials, particularly for messaging platforms. Organizations should also review logs for connections to 20.255.49.229 and the R12 SSL certificate fingerprint to identify potential exposure. Given the domain's current offline status, continuous monitoring for reactivation or related infrastructure is recommended.