mstoolsnetshop[.]com

The domain mstoolsnetshop.com was registered on August 22, 2024 through Web Commerce Communications Limited and is currently hosted on an Ultahost infrastructure (AS214036) in Germany, resolving to IP address 212.224.107.238. All four authoritative nameservers (ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, ns4.ultahost.com) resolve to the same provider, indicating a single‑tenant hosting environment. No TLS certificate is presented for the site, confirming that it operates without HTTPS protection. The public page title returned by the HTTP response is "Home - Buy, Swap PHP Scripts, WordPress Themes and more", which does not reference the targeted brand and suggests that the site may be repurposed or used as a landing page for malicious payloads.

The domain is classified as a brand‑impersonation campaign targeting WhatsApp, a conclusion supported by the explicit "Impersonates: whatsapp" tag in the intelligence feed. Gridinsoft assigns a trust score of 0 / 100, indicating a high likelihood of malicious intent. Reputation data show the domain appears on three security blocklists and has been actively blocked by PhishDestroy, ScamSniffer, and Enkrypt. VirusTotal analysis recorded ten of ninety‑five scanners flagging the domain, reinforcing the suspicion of malicious activity.

As of the reporting date (July 25, 2026) the site is offline, but the underlying infrastructure remains reachable. Defenders should add mstoolsnetshop.com and its resolving IP 212.224.107.238 to deny‑list rules, monitor for any re‑activation, and enforce strict outbound filtering for connections to this host. Continuous observation of the associated nameservers and the hosting ASN is advised, as threat actors frequently re‑use the same provider for subsequent campaigns.