undian-whatsapp58[.]blogspot[.]com

This domain, undian-whatsapp58.blogspot.com, is flagged as an active high-risk brand impersonation site targeting WhatsApp users through a tech support scam framework. Analysis indicates the domain was registered on March 5, 2026, and remains operational as of July 12, 2026, serving content with an HTTP 200 status. The page title explicitly displays 'WhatsApp,' aligning with the reported scam type of tech support fraud, though the exact content and interaction flow of the site have not yet been analyzed. Infrastructure analysis reveals the domain resolves to IP address 142.250.187.193, which is hosted on autonomous system AS15169 under Google LLC in Germany. The SSL certificate is issued by Google Trust Services, suggesting the use of legitimate hosting infrastructure to lend credibility to the fraudulent operation. Despite the seemingly trustworthy technical underpinnings, the domain holds a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, with 16 out of 95 security vendors on VirusTotal flagging it as malicious. The domain also appears on at least one security blocklist and is actively blocked by PhishDestroy. What remains uncertain is the precise mechanism of the tech support scam, including whether it employs fake alerts, redirect chains, or social engineering scripts to deceive users. The use of a Blogspot subdomain may indicate an attempt to exploit a free hosting service to evade detection, though the domain is registered through MarkMonitor, a legitimate registrar often used for both legitimate and malicious purposes. Defenders should treat this domain as confirmed malicious and prioritize blocking it at the DNS, IP, and URL levels. Network logs should be reviewed for connections to 142.250.187.193 or the domain itself, particularly from endpoints where WhatsApp-related activity is unexpected. Given the high-risk classification and active status, proactive takedown requests to the hosting provider and registrar may also be warranted.