whats-xyw[.]vip

Analysis of the domain whats-xyw.vip indicates a confirmed brand impersonation campaign targeting WhatsApp users, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, and resolved to the IP address 20.2.67.40, hosted under AS8075 (Microsoft Corporation) in Hong Kong. Infrastructure review reveals the use of an SSL certificate (R12), a common indicator in phishing operations to lend false legitimacy to fraudulent sites. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 17 of 95 security vendors in VirusTotal scans, reinforcing its classification as malicious.

AlienVault OTX records the domain in 12 threat intelligence pulses, suggesting active tracking by security researchers. Gridinsoft assigns a trust score of 0/100, further corroborating its fraudulent nature. While the exact content of the site remains unanalyzed, the domain’s structure and naming convention align with known WhatsApp phishing schemes, where attackers impersonate the brand to harvest credentials or distribute malware. Defenders should treat this domain as compromised and block all resolutions at the DNS level.

Historical detection data confirms its removal from active service, but residual risks may persist through cached records or secondary distribution channels. No evidence suggests the use of a phishing kit or additional threat vectors beyond brand impersonation. Monitoring for re-registration or similar domains (e.g., typosquatting variants) is recommended.