web[.]whastsnapp[.]com

The domain web.whastsnapp.com was registered on 04 November 2025 through GKG.NET, INC. and is delegated to the authoritative name servers ns3.gkg.net and ns4.gkg.net. DNS resolution points to the IP address 159.223.67.46, which belongs to AS14061 DigitalOcean, LLC and is geolocated in Singapore. No TLS certificate is presented for the host, indicating that the site operates only over HTTP. The page title returned when the site was reachable reads “WhatsApp網頁版官网入口 - 無需安裝跨裝置同步通訊”, which does not reference the advertised brand but the domain is classified as a brand‑impersonation campaign targeting Dropbox.

VirusTotal analysis shows that 15 of 95 scanned security vendors flagged the domain as malicious. Independent scoring from Gridinsoft assigns a trust rating of 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has also listed the site as blocked. Current operational status is offline, suggesting the infrastructure has been taken down or is temporarily inaccessible. Evidence confirms the use of a reputable cloud provider (DigitalOcean) for hosting, a common tactic to blend malicious traffic with legitimate services.

The lack of HTTPS, low trust score, and multiple vendor detections collectively indicate a high likelihood of credential‑harvesting or other malicious activity. However, without a live sample of the landing page, the exact payload, credential‑capture mechanism, and any secondary redirect infrastructure remain unknown. Defenders should continue to block the IP 159.223.67.46 and the domain web.whastsnapp.com at network perimeters, update URL filtering rules, and monitor for any re‑registration attempts. Additional observation of DNS queries for the associated name servers may reveal future campaigns that reuse the same hosting footprint. Threat intelligence teams are advised to correlate this indicator with other Dropbox‑related phishing reports to assess campaign scope.