whats-xtl[.]vip

This domain, whats-xtl.vip, operates as a credential harvesting site designed to mimic WhatsApp login pages. The site attempts to trick users into entering their account credentials, which are then captured by threat actors for unauthorized access or further malicious activities. Such phishing pages often lead to account takeovers, data breaches, or the spread of additional malware through compromised accounts. Analysis indicates the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with phishing infrastructure. Security vendors have flagged the domain, with 18 out of 95 engines on VirusTotal detecting it as malicious. Additionally, it appears on two security blocklists and is actively blocked by multiple threat intelligence platforms, including those specializing in phishing detection. If you visited whats-xtl.vip or entered credentials on a similar site, immediately change your WhatsApp password and enable multi-factor authentication. Review your account for unauthorized logins or suspicious activity. Scan your device for malware using updated security tools, as phishing sites may deploy additional payloads. Report the incident to your organization’s security team or relevant authorities to help mitigate further risks.