whatp1823cpaenlhuh[.]live

This report analyzes the domain whatp1823cpaenlhuh.live, which is assessed as a potential threat. The page title "GVoice" indicates the site is likely impersonating the Google Voice service, a common vector for voice phishing (vishing) and account takeover scams. The threat posed is that visitors may be tricked into providing Google Voice verification codes or login credentials, leading to unauthorized account access or financial fraud.

Technical evidence shows the domain was created recently on 2026-02-21, a hallmark of disposable scam infrastructure. It is registered through NiceNIC International Group Co., Limited, a registrar often associated with low-reputation domains. VirusTotal reports 3 out of 95 security vendors flagged the site as malicious, specifically Fortinet, Gridinsoft, and SOCRadar. The domain resolves to IP address 104.21.52.178, hosted in the United States by Cloudflare, Inc. (AS13335). SSL certificates are issued by Google Trust Services / WE1, and nameservers are vita.ns.cloudflare.com and anton.ns.cloudflare.com. The domain is listed on 1 blocklist.

As of this report, the domain is offline. The risk level is assessed as moderate based on the low detection rate (3/95) and recent creation date, but the impersonation of a legitimate brand and the nature of the scam elevate the potential impact. Monitoring for reactivation is recommended.