whats-xyd[.]vip

The domain whats-xyd.vip, registered through Gname.com Pte. Ltd. on October 24, 2025, is currently offline and has been taken down by the PhishDestroy takedown service. Infrastructure analysis shows the domain resolves to the IPv4 address 20.2.67.40, which belongs to the Microsoft Corporation network (AS8075) and is geolocated in Hong Kong. The authoritative name servers are a.share-dns.com, a9.share-dns.com, b.share-dns.net, and b9.share-dns.net, a pattern often observed in rapidly provisioned malicious hosting. The domain appears on a single security blocklist, and 18 of 95 security vendors on VirusTotal have flagged it as malicious, indicating moderate consensus among scanning engines.

AlienVault OTX has linked the address to 17 distinct threat‑intelligence pulses, reinforcing its association with known malicious activity. The site lacks an SSL/TLS certificate, exposing any traffic to clear‑text interception. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of credibility.

The campaign is classified as brand impersonation targeting WhatsApp, as indicated by the threat type and brand target fields. Defenders should add 20.2.67.40 and the domain name to outbound and inbound filtering rules, monitor for any residual DNS queries, and consider broader indicator‑of‑compromise (IOC) sharing with partners. Continuous verification of blocklist status is advised, as the domain may be resurrected on alternative infrastructure if the underlying threat actor persists.