whats-xye[.]vip

The domain whats-xye.vip is identified as a phishing site specifically designed to impersonate WhatsApp login portals. This fraudulent infrastructure targets users by presenting a counterfeit authentication interface to harvest credentials. As of the latest assessment, the domain has been taken offline, though prior activity indicates a deliberate attempt to deceive users into submitting sensitive account information. Analysis of technical indicators reveals that whats-xye.vip was flagged by 17 of 95 security vendors on VirusTotal, reflecting a consensus on its malicious nature. The domain was registered on February 21, 2026, through an undisclosed registrar, and resolved to the IP address 20.2.67.40, hosted under AS8075 (Microsoft Corporation) in Hong Kong. The site appears on two security blocklists, including PhishDestroy and PhishingDB, and utilized an SSL certificate identified as R13. These factors collectively underscore the domain’s role in a coordinated phishing campaign. At present, whats-xye.vip is offline, reducing immediate exposure risk. However, users who may have interacted with the domain should immediately revoke any submitted credentials and enable multi-factor authentication on their accounts. Organizations are advised to monitor for residual DNS queries to 20.2.67.40 and update blocklists to include this domain and its associated infrastructure. Proactive threat hunting for related registrations or SSL certificates is recommended to mitigate potential follow-up attacks.