whats-xyr[.]vip

The domain whats-xyr.vip was registered on February 21, 2026 and currently resolves to the IP address 20.2.67.40, which is geolocated in Hong Kong and belongs to AS8075 owned by Microsoft Corporation. The domain’s SSL certificate is identified as R12, indicating a standard X.509 certificate without additional trust extensions. Infrastructure analysis shows the domain is presently taken offline, yet historical activity placed it on a single security blocklist and it has been blocked by the PhishDestroy service. Threat intelligence from AlienVault OTX records the domain in thirteen separate pulses, confirming repeated observation by the community.

VirusTotal scans report that seventeen of ninety‑three security vendors flagged the domain, suggesting a moderate level of detection confidence. The combination of OTX pulse count, blocklist presence, and multi‑vendor detections aligns with a generic phishing classification. However, the exact phishing payload, targeted brand, or page title has not been disclosed, leaving the specific lure and victim profile uncertain.

Defenders should continue to block the domain and its associated IP address at network perimeter devices, include the domain in internal URL filtering lists, and monitor DNS queries for any resurgence. Ongoing observation of the IP’s activity within Microsoft’s AS8075 range is advised, as compromised cloud resources could be repurposed. Organizations should also verify that outbound traffic to the IP is restricted, especially from user workstations, and consider sharing the indicator set with threat‑sharing platforms to enhance collective awareness.