whats-xwt[.]vip

whats-xwt.vip is flagged as a brand‑impersonation site targeting WhatsApp. The domain was registered on 11 October 2025 through Gname.com Pte. Ltd. and uses the public nameservers a.share-dns.com, a8.share-dns.com, b.share-dns.net and b8.share-dns.net. DNS resolution points to 20.205.130.221, an address owned by Microsoft Corporation (ASN 8075) and geolocated to Hong Kong. No TLS certificate is presented, indicating the site is served over plain HTTP. The host is currently taken offline, yet historical data shows the domain appeared on a single security blocklist and is actively blocked by PhishDestroy.

Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100). VirusTotal scans have recorded 18 detections out of 95 participating vendors, reinforcing the malicious classification. AlienVault OTX lists the domain in four separate threat‑intel pulses, further corroborating its use in malicious campaigns. The observed threat vector aligns with the declared scam type of brand impersonation, specifically attempting to lure victims into believing the site is an official WhatsApp service.

Because the infrastructure leverages a Microsoft‑owned IP range, attribution to a specific actor remains ambiguous; the hosting choice may be intended to blend with legitimate traffic. Defenders should immediately add 20.205.130.221 and the fully qualified domain name to network‑level deny lists, enforce DNS‑level blocking for the listed nameservers, and monitor for any re‑registration attempts. Continuous threat‑intel feeds should be consulted for new OTX pulses or additional vendor detections. Given the low trust score, multiple vendor flags, and presence on blocklists, the domain should be treated as high‑confidence malicious despite its offline status.