whatsapp[.]xolura[.]com

Analysis on July 23, 2026 indicates that whatsapp.xolura.com remains active and continues to resolve to the IPv4 address 128.199.171.235. The domain was registered on June 21, 2016 through Namecheap Inc and is delegated to the authoritative name servers dns1.registrar-servers.com and dns2.registrar-servers.com. Current threat intelligence classifies the domain as a generic phishing infrastructure; it is listed on one public security blocklist and has been manually blocked by the PhishDestroy filtering service.

VirusTotal reports that nine out of ninety‑five scanning engines have flagged the domain as malicious, corroborating the phishing designation. No additional data such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, Open Threat Exchange references, trust‑score metrics, or page‑title information have been published for this host, leaving those vectors unverified. The lack of publicly disclosed page content means defenders cannot confirm the exact lure or credential‑capture mechanism employed, only that the domain is associated with a high‑risk phishing campaign.

Defensive recommendations include adding the domain and its resolving IP address (128.199.171.235) to outbound and inbound deny lists, ensuring DNS resolvers block queries for whatsapp.xolura.com, and confirming that existing email security gateways enforce URL filtering against the known blocklist entry. Continuous monitoring of the hosting provider and name‑server changes is advised, as alterations could signal a shift in the underlying infrastructure. Organizations should also review any recent user‑reported incidents that reference WhatsApp‑related login prompts, as the domain name suggests a possible impersonation attempt, and apply heightened scrutiny to any credential submissions directed to this host.