whatshtf[.]cc

The domain whatshtf.cc was observed resolving to the IPv4 address 103.99.210.14, which belongs to the Korean autonomous system AS205960 operated by HDTIDC LIMITED. Registration data shows the domain was created on 11 October 2025 through Dominet (HK) Limited, and the authoritative nameservers are ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainname. No TLS certificate is presented; the site does not serve HTTPS, resulting in a trust score of zero out of one hundred according to Gridinsoft. Threat intelligence sources label the domain as a Facebook brand impersonation, although the page title returned by the server reads “whatsapp download| 使用動態表情的技巧：讓你的聊天更有趣”, indicating possible content unrelated to Facebook.

The domain is currently taken offline, yet it has been listed on a single security blocklist and was blocked by the PhishDestroy service. VirusTotal analysis returned fifteen positive detections out of ninety‑five scanners, reinforcing the malicious classification. AlienVault OTX records show the domain appears in six distinct threat pulses, providing additional corroboration of its use in abuse campaigns.

The limited blocklist presence and the offline status leave the current hosting activity uncertain, but the combination of a low trust score, lack of encryption, multiple detections, and corroborating OTX references suggests the domain was employed for credential‑stealing or fraudulent redirection targeting Facebook users. Defenders should ensure that DNS queries for whatshtf.cc are denied, block the associated IP address at network perimeters, and add the domain to internal URL filtering lists. Continuous monitoring of the registrar’s new registrations and the observed nameserver set is advised to detect potential re‑use, and any future re‑appearance should be escalated for rapid takedown.