whats-xwg[.]vip

This domain, whats-xwg.vip, poses a targeted brand impersonation threat against WhatsApp users. Analysis indicates the domain was designed to deceive victims into believing they are interacting with the official WhatsApp platform, likely for credential theft or unauthorized account access. The domain’s infrastructure and naming convention—combining "whats" with random characters—suggests an attempt to exploit user trust in the WhatsApp brand while evading basic detection mechanisms. Given the absence of an SSL certificate and its recent creation, this domain exhibits characteristics consistent with short-lived phishing campaigns aimed at rapid exploitation before takedown. Evidence supporting the malicious classification of whats-xwg.vip includes its detection by 18 out of 95 security vendors on VirusTotal, indicating a moderate to high confidence level in its malicious intent. The domain was registered on October 11, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 20.2.67.40, hosted on Microsoft Corporation’s AS8075 in Hong Kong, a common infrastructure choice for threat actors leveraging cloud services. Additionally, the domain appears on two security blocklists, further corroborating its classification as a brand impersonation threat targeting WhatsApp. Users who visited whats-xwg.vip should immediately revoke any sessions or credentials entered on the site. If login details were submitted, reset passwords for WhatsApp and any other accounts where the same credentials may have been reused. Monitor financial and communication accounts for unauthorized activity, as compromised credentials could lead to further exploitation. Organizations should update their web filtering policies to block this domain and its associated IP address, 20.2.67.40, to prevent further exposure. Given the domain’s current offline status, continued vigilance is advised, as threat actors may re-deploy similar infrastructure under new domains.