whats-znf[.]vip

whats-znf.vip is a newly registered domain (created 21 February 2026) that has been observed hosting a brand‑impersonation campaign targeting WhatsApp users. Analysis of public threat‑intelligence sources shows that the domain resolves to the IP address 20.2.208.17, which is allocated to AS8075 Microsoft Corporation and geolocated to Hong Kong. The TLS certificate presented by the host is identified as “R12”, indicating a standard SSL deployment without unusual extensions. On VirusTotal the domain was submitted to 95 scanning engines, of which 16 returned a positive classification, confirming that multiple security vendors consider the host malicious. AlienVault OTX lists the domain in twelve separate threat‑intel pulses, and it appears on one public blocklist.

The domain is also listed as blocked by the PhishDestroy service. Current network measurements indicate that the host is no longer reachable; the domain status is reported as offline at the time of this analysis (23 July 2026). The available evidence points to a short‑lived infrastructure that was likely used to distribute WhatsApp‑related credential‑stealing links or messages. No public page title or HTTP response body has been captured, so the precise content served by the site remains unknown.

Likewise, the specific phishing kit or payload has not been disclosed in the open‑source data. Defenders should update URL filtering and DNS blocklists to include the domain and its resolved IP address, monitor for any resurgence of the same IP range, and consider adding the ASN (AS8075) to watchlists if further malicious activity is observed. Because the domain is already offline, incident response teams should focus on detection of any residual malicious URLs that may have been cached or shared, and on educating users about unsolicited WhatsApp messages that request login details. Ongoing vigilance is recommended, especially given the rapid registration‑to‑abuse timeline demonstrated by this case.