whoispps[.]com

PhishDestroy identifies whoispps.com as an active brand impersonation domain designed for credential theft. This threat involves the deceptive replication of legitimate service interfaces to capture user login details, passwords, and sensitive account information. The domain’s behavior aligns with the tactics used by generic phishing operators to compromise user accounts across multiple platforms.

This domain was flagged on August 20, 2023, and currently resolves to IP 134.122.125.163. It is registered through Fewmoretaps OU d/b/a Trustname.com and secured with a Let’s Encrypt SSL certificate. Despite zero detections on VirusTotal as of the latest scan (0/95), the domain remains unlisted on major blocklists and has not yet accumulated trust scores from reputable domain reputation services. The combination of recent creation, unvetted registrar, and absence of detection flags indicates a potentially emerging or evolving threat actor operation.

Users are strongly advised to avoid interacting with whoispps.com or any associated links. If credentials were entered, change passwords immediately and enable multi-factor authentication on all linked accounts. Report the domain to your email provider, security teams, and platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group. Network administrators should block the domain and IP at the firewall level to prevent internal exposure. Monitor for unauthorized access or anomalous login activity following potential exposure.