whats-zht[.]vip

The domain whats-zht.vip has been identified as a high-risk phishing site specifically targeting WhatsApp users. Analysis indicates this infrastructure was designed to impersonate the official WhatsApp platform, likely for credential harvesting or distribution of malicious payloads. The domain is currently offline, though its prior activity warrants continued monitoring due to its association with fraudulent schemes. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, an unusually future-dated creation that may indicate automated or bulk registration practices. Detection metrics confirm its malicious nature: 17 of 95 security vendors on VirusTotal flagged the domain as phishing, while two independent blocklists—PhishDestroy and PhishingDB—have listed it as a confirmed threat. Google Safe Browsing also classified the domain under its phishing category. No associated IP addresses were provided in the initial data, but the registrar’s historical patterns suggest potential ties to broader phishing campaigns. Current status indicates the domain has been taken offline, though its registration remains active. Organizations and users are advised to block all traffic to whats-zht.vip at the network level and monitor for any reemergence under similar naming conventions. Endpoints should be scanned for indicators of compromise if prior access occurred. Given the domain’s future-dated registration, security teams should investigate potential links to other suspicious domains registered through the same provider during the same period.