tthj-wahtsapp[.]com

PhishDestroy identifies tthj-wahtsapp.com as a generic phishing domain designed to deceive users into believing they are accessing a legitimate WhatsApp service. The domain name mimics the official WhatsApp URL, a common tactic to steal login credentials or personal information. Although currently offline, its recent registration and rapid flagging indicate an active threat campaign.

Technical analysis reveals strong evidence of malicious intent. The domain resolves to IP address 103.80.133.40 and is registered through GKG.Net, Inc. It was created on February 21, 2026, a very recent date that aligns with phishing campaigns. VirusTotal reports that 17 out of 95 security vendors flag this domain, while it appears on 2 security blocklists. Additionally, AlienVault OTX found it in 14 threat intelligence pulses, and its SSL certificate is issued by Let's Encrypt / R12, often abused by phishing sites. The page title returned a 403 Forbidden error, suggesting access controls were in place.

Users who visited tthj-wahtsapp.com should immediately change any passwords entered on the site and enable two-factor authentication on their WhatsApp account. It is also advisable to run a full antivirus scan and monitor financial accounts for suspicious activity. PhishDestroy recommends blocking this domain and reporting it to relevant authorities to prevent future victims.