moveinbreeze[.]com

This domain, moveinbreeze.com, is identified as a phishing infrastructure designed to impersonate WhatsApp, a widely used messaging application. The site presents a fraudulent login interface to trick users into submitting their credentials, which are then harvested by threat actors for unauthorized access, account takeovers, or further malicious activities such as spam propagation or financial fraud. The page title explicitly displays 'WhatsApp,' indicating a targeted attempt to mimic the legitimate service and exploit user trust in the brand. Analysis of the domain reveals multiple technical indicators of malicious activity. The domain was registered on April 13, 2026, through Dynadot Inc, a registrar frequently associated with phishing and fraudulent registrations. Security engines on VirusTotal flagged the domain as malicious, with 19 out of 95 vendors detecting it as a threat. Additionally, the domain appears on at least one security blocklist and was proactively blocked by enterprise-grade filtering systems. Infrastructure analysis further confirms its offline status, though historical data suggests it was actively used in credential harvesting campaigns. Users who may have interacted with moveinbreeze.com should take immediate remedial actions to mitigate potential risks. Those who entered credentials should assume their accounts are compromised and initiate password resets for WhatsApp and any other services where the same credentials were reused. Enabling multi-factor authentication (MFA) is strongly recommended to prevent unauthorized access. Affected users should also monitor their accounts for suspicious activity, such as unauthorized logins or messages sent without their consent. If financial or personal data was entered, additional steps such as credit monitoring or reporting to relevant authorities may be necessary. Organizations should update their blocklists to include this domain and educate users on recognizing phishing attempts targeting messaging platforms.