7[.]600212[.]xyz

Analysis as of 23 July 2026 flags the domain 7.600212.xyz as an elevated‑risk brand‑impersonation site targeting WhatsApp users. The domain resolves to 192.253.229.153, an address assigned to AS152194 (CTG Server Limited) in Hong Kong. Registration occurred on 21 May 2025 through Porkbun LLC, using the default Porkbun nameservers (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com). No TLS certificate is presented, indicating the site serves only HTTP traffic. The page title returned from the live host was “WhatsApp Web”, matching the declared brand target of WhatsApp and the classified scam type of brand impersonation.

Reputation services provide a uniformly negative rating: Gridinsoft assigns a trust score of 0 / 100, while Scamadviser rates the domain 1 / 100. VirusTotal scans show 14 of 95 antivirus/URL engines flag the domain as malicious, reinforcing the suspicion. The domain appears on a single external blocklist and is listed by PhishDestroy as blocked, confirming that at least one security provider has taken mitigation action. The site is currently offline, limiting immediate threat exposure, yet the infrastructure components remain in place. Uncertainty remains around the specific payload or credential‑harvesting mechanisms, as no page content or HTTP response details have been captured.

Likewise, the presence of any additional command‑and‑control infrastructure or post‑compromise activity cannot be confirmed. Defenders should continue to monitor DNS queries for 7.600212.xyz and the associated IP address, enforce blocklists that include this domain, and consider adding the IP to network‑level deny lists. Organizations that implement WhatsApp Web authentication should educate users about the absence of HTTPS on suspicious URLs and encourage verification of certificate presence.