whatsappplus[.]com[.]pk

The domain whatsappplus.com.pk was observed as a brand‑impersonation vector targeting Apple users. The site is currently offline, and its last known HTTP response indicated no SSL certificate was deployed. Registration metadata show the domain was created on 3 March 2025, with the registrar not disclosed. DNS resolution points to the IPv4 address 31.43.191.79, which belongs to AS210848 operated by Telkom Internet LTD in the Netherlands.

The authoritative name servers are ns1.symbolhosts.com and ns2.symbolhosts.com. VirusTotal has recorded 15 detections out of 95 scanners, and the domain appears on a single external blocklist. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy lists the domain as blocked. The page title retrieved prior to takedown references “Whatsapp Plus Apk 18.80 | (Official) Latest Version (Anti‑Ban) – Whatsapp Plus”, indicating a possible attempt to lure users of the WhatsApp application, yet the declared brand target is Apple, suggesting a broader social‑media phishing campaign.

The evidence confirms the presence of malicious infrastructure, but the exact payload or phishing page content was not captured before the offline action. Defenders should continue to block the IP address 31.43.191.79, add the domain to internal URL filtering lists, and monitor for any re‑registration attempts under similar names. Ongoing vigilance is recommended given the elevated risk rating and the low trust score, as actors may reuse the underlying hosting or name‑server configuration for future campaigns.