vxrf-wahtsapp[.]com

PhishDestroy has identified vxrf-wahtsapp.com as a confirmed brand impersonation threat, specifically targeting Gmail users through a deceptive login page titled 'whatsapp网页版登录网址 - 浏览器中安全群聊 | WhatsApp'. Despite the page title referencing WhatsApp, the domain's actual impersonation target is Gmail, indicating a broad phishing campaign designed to harvest credentials across platforms. The domain was created on September 28, 2025, and its registration through GKG.NET, INC. suggests a possibly bulk or automated phishing operation.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports that 18 out of 95 security vendors flag this domain, and it appears on 2 security blocklists. The domain resolves to IP address 103.80.133.44 and is secured with a Let's Encrypt / R12 SSL certificate, which, while legitimate for encryption, does not validate the site's trustworthiness. AlienVault OTX has recorded it in 16 threat intelligence pulses, reinforcing its association with ongoing phishing activity. Notably, Google Safe Browsing (GSB) status was not provided, but the high blocklist presence and vendor flags strongly indicate the domain was actively used for credential theft.

As of the latest check, vxrf-wahtsapp.com is offline, suggesting that hosting providers or registrars have taken action to suspend the site. However, the remaining risk is moderate: the same threat actors may register similar domains or repurpose the infrastructure. Users who may have visited the site and entered credentials should immediately change their passwords and enable two-factor authentication on their Gmail accounts. PhishDestroy recommends always verifying the legitimacy of any login page by checking the URL carefully and using trusted bookmarks rather than clicking links from unsolicited messages.