whats-znz[.]vip

The domain whats-znz.vip was registered through Gname.com Pte. Ltd. on 21 February 2026. Its authoritative name servers are a2.share-dns.com and b2.share-dns.net, which resolve the domain to the IPv4 address 20.2.208.17 hosted in the Microsoft Azure eastasia region, physically located in Hong Kong. Google Safe Browsing has classified the site under the “social engineering” category, indicating a high likelihood of credential‑stealing behavior. Independent analysis on VirusTotal shows that 18 of 95 scanned security engines flagged the domain, reinforcing the malicious assessment. The domain appears in fourteen AlienVault OTX pulses and is listed on one external security blocklist, demonstrating that multiple threat‑intelligence feeds have observed activity associated with it.

PhishDestroy also reports the domain as blocked. The current operational status is offline, which may be a temporary takedown or a deliberate self‑removal after a campaign burst. No public SSL certificate details, HTTP response codes, or page‑title information have been released, so the exact content of the hosted page remains unconfirmed. Likewise, the specific lure or credential‑capture vector employed by the site has not been publicly documented beyond the generic “phishing” label.

Defenders should incorporate the domain and its resolving IP address into their inbound and outbound filtering rules. Because the IP belongs to Azure’s East Asia cloud, static IP blocking may affect legitimate services; therefore, a combination of DNS‑based blocklists (including the known blocklist entry and the OTX pulse identifiers) and URL filtering is recommended. Continuous monitoring of the registrar Gname.com Pte. Ltd. for new registrations that reuse the same name‑server pair is advisable, as threat actors often recycle infrastructure.