whats-xwy[.]vip

The domain whats-xwy.vip was registered on 11 October 2025 through Gname.com Pte. Ltd. and currently resolves to the Microsoft‑owned IP address 20.205.130.221, which is situated in Hong Kong under ASN 8075. No TLS certificate is presented, meaning any traffic to the site would be unencrypted. Its page title is exactly "whats-xwy.vip" and the domain is categorized as a brand‑impersonation campaign targeting WhatsApp. It appears on a single public security blocklist and is specifically listed by PhishDestroy as a malicious entry. Gridinsoft has assigned a trust score of 0 out of 100, indicating extreme suspicion.

VirusTotal analysis records that 17 of 95 scanning engines flag the domain as malicious, reinforcing the blocklist evidence. AlienVault OTX references the domain in sixteen separate threat‑intel pulses, showing that the indicator has been circulated widely among security communities. Authoritative name servers are a.share-dns.com, a12.share-dns.com, b.share-dns.net, and b12.share-dns.net, which are commonly associated with disposable hosting services. Although the domain’s current status is offline, the underlying hosting infrastructure remains reachable. Uncertainties remain because no content snapshot or phishing‑kit details are publicly available, and the absence of SSL prevents verification of any credential‑harvesting mechanisms.

Nonetheless, the combination of blocklist inclusion, low trust score, and multiple vendor detections provides sufficient confidence that the domain was used for malicious impersonation. Defenders should block the domain and its resolving IP address, enforce DNS sinkholing, and monitor for new subdomains that resolve to the same Microsoft IP range. Given the shared DNS infrastructure, related hostnames using the same name servers should be reviewed. Continuous monitoring of threat‑intel feeds such as OTX and vendor‑specific feeds is recommended to capture any emerging activity associated with this indicator.