web[.]whats-app[.]top

Analysis as of July 23, 2026 indicates that the domain web.whats-app.top was registered on February 21, 2026 and currently resolves to the IPv4 address 154.221.9.140. The address is advertised as belonging to Hong Kong and is announced by AS137951 under the name ASLINE LIMITED. VirusTotal has recorded 13 positive detections out of 93 scanned security vendors, confirming that multiple antivirus engines classify the domain as malicious. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service.

The TLS certificate presented by the site is identified as R13, suggesting a low‑trust or self‑signed certificate. The page title returned by the HTTP response is “WhatsApp Web”, which contradicts the declared impersonation target of Apple and may be used to lure victims familiar with messaging services. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the site’s legitimacy. The threat is categorized as a brand‑impersonation campaign employing a tech‑support scam narrative.

The risk level is elevated, and the domain’s current status is offline, indicating that the operator may have removed the site after initial distribution. Defenders should continue to block the domain at network perimeter devices, add the associated IP address 154.221.9.140 to deny‑list rules, and monitor for any re‑appearance of the domain or related infrastructure. Analysts should also correlate the 13 VirusTotal detections with known malicious payloads to identify any download or command‑and‑control patterns. Because the site is no longer reachable, active probing is not possible, and further intelligence must rely on historical request logs and third‑party telemetry.