whats-zsm[.]vip

This domain, whats-zsm.vip, is identified as a credential theft phishing site specifically targeting WhatsApp users. Analysis indicates the infrastructure was designed to impersonate the legitimate messaging platform, tricking victims into submitting login credentials. The domain is currently offline, though prior activity suggests it was actively harvesting account details for unauthorized access or further exploitation. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Security vendors flagged the domain on VirusTotal, with 17 of 95 engines detecting malicious activity. The domain appears on two independent security blocklists, including entries from PhishDestroy and PhishingDB. Google Safe Browsing also classified the domain as phishing, reinforcing its malicious intent. No associated IP addresses or hosting providers were provided in the initial data, but the rapid takedown suggests intervention by security teams or hosting providers. The current offline status reduces immediate risk, but the domain’s infrastructure remains a potential threat if reactivated. Organizations should proactively block the domain at the DNS or proxy level to prevent accidental access. Users who may have interacted with the site should be instructed to reset WhatsApp credentials immediately and enable multi-factor authentication. Security teams are advised to monitor for related domains registered under the same registrar or using similar naming conventions, as threat actors often reuse infrastructure patterns. Logs from February 21, 2026, onward should be reviewed for connections to this domain to identify potential credential exposure.