whats-xtk[.]vip

Analysis indicates that the domain whats-xtk.vip was registered on 21 February 2026 and is currently taken offline. The domain resolves to the IP address 20.2.67.40, which is assigned to Microsoft Corporation (AS8075) and geolocated in Hong Kong. The TLS certificate presented is identified as R12, confirming that encrypted connections were available before the takedown. Threat intelligence from AlienVault OTX lists the domain in fourteen separate pulses, highlighting recurring observations across multiple feeds.

The domain is also listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal scans show that sixteen out of ninety‑three antivirus and URL‑reputation engines flagged the domain as malicious, reinforcing the observed malicious intent. The available data classify the activity as generic credential‑harvesting phishing, though the specific target brand or page title has not been disclosed.

Consequently, the precise content and lure used by the site remain unknown pending further content analysis. Defenders should continue to block the domain at network perimeter devices, update DNS filtering rules, and monitor for any resurgence of the host or associated IP range. Additional investigation of the SSL certificate details and correlation with other Microsoft‑hosted infrastructure may reveal further malicious payloads or command‑and‑control endpoints.