whats-xrz[.]vip

This domain, whats-xrz.vip, was registered on October 16, 2025 through Gname.com Pte. Ltd. and resolves to the IPv4 address 20.2.67.40, which belongs to AS8075 Microsoft Corporation and is geolocated in Hong Kong. The domain does not present an SSL certificate, and its authoritative nameservers are a.share-dns.com, a2.share-dns.com, b.share-dns.net, and b2.share-dns.net. Threat intelligence indicates that the site was used for WhatsApp brand impersonation, and it has been taken offline as of the reporting date. PhishDestroy has already blocked the domain, and it appears on a single security blocklist.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal analysis shows that 18 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion. AlienVault OTX references the domain in two separate threat‑intel pulses, providing additional corroboration. The lack of an SSL certificate and the low trust score suggest that the infrastructure was not designed for legitimate traffic.

Current visibility is limited to historical data; no live HTTP response or page title has been captured, so the exact content of the site remains unknown. Defenders should continue to block the IP address 20.2.67.40, add the domain to local deny lists, and monitor for any re‑registration attempts. Ongoing correlation with threat‑intel feeds, especially OTX and VirusTotal, is recommended to detect potential re‑use of the same infrastructure.