whats-zna[.]vip

The domain whats-zna.vip has been identified as a credential theft operation specifically targeting WhatsApp users. Analysis indicates the site masquerades as the legitimate messaging platform to deceive victims into submitting login credentials, which are then harvested for malicious purposes. The domain is currently offline, though its infrastructure remains a documented threat. Infrastructure analysis reveals the domain was registered on February 21, 2026, through an undisclosed registrar. It resolves to the IP address 20.255.49.229, hosted under AS8075 (Microsoft Corporation) in Hong Kong. Security vendors have flagged the domain, with 17 of 95 VirusTotal engines detecting it as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB. Its SSL certificate, identified as R12, provides no additional trust indicators due to the domain's fraudulent nature. Current status indicates the domain has been taken offline, though its prior activity and detection metrics warrant continued vigilance. Organizations and users are advised to block the domain and its associated IP at the network level. Security teams should monitor for similar impersonation attempts targeting messaging platforms, particularly those using slight domain variations (e.g., misspellings or appended terms like 'zna'). End-users should verify domain authenticity before entering credentials and enable multi-factor authentication where available to mitigate credential theft risks.