verify-whatsapp[.]webcindario[.]com

Analysis of verify-whatsapp.webcindario.com indicates an active credential phishing campaign targeting WhatsApp users. The domain, registered through TUCOWS.COM, CO. on February 28, 2001, resolves to the IP address 5.57.226.202 and utilizes Google Cloud nameservers (ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, ns-cloud-d3.googledomains.com). As of July 24, 2026, the domain remains operational and is flagged by 12 of 91 security vendors on VirusTotal, suggesting moderate but not universal detection. It appears on two security blocklists, including PhishDestroy and OpenPhish, which classify it as a phishing threat.

Infrastructure analysis reveals no recent domain registration anomalies, though the long-standing creation date may indicate repurposing of an older domain for malicious activity. The use of Google Cloud nameservers is not inherently suspicious but may aid in evading certain reputation-based filters. The IP address 5.57.226.202 has not been extensively profiled in public threat intelligence feeds at this time, limiting attribution to specific hosting providers or threat actors. Defenders should treat this domain as high-risk for credential theft. Network-level blocking is recommended, particularly for organizations with exposure to consumer messaging platforms.

Endpoint protection vendors that have not yet flagged this domain should prioritize signature updates. Given the domain's continued activity and blocklist presence, monitoring for related infrastructure (e.g., subdomains, redirect chains) is advised. The exact content and phishing kit in use remain unconfirmed, though the domain name strongly implies a WhatsApp verification-themed lure. No evidence links this campaign to broader scam categories such as investment fraud or crypto drainers.