waplsapp[.]com

This domain is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting Facebook. The site resolves to 104.131.28.183, an IP owned by DigitalOcean (AS14061) located in the United States. It was registered on March 13 2025 through REGISTER S.P.A. and uses Cloudflare name servers (joel.ns.cloudflare.com, leanna.ns.cloudflare.com). Technical fingerprinting shows a WordPress stack with MySQL, PHP, Yoast SEO (both free and premium) and Nginx, protected by a Let's Encrypt certificate (R12). The page title observed is “WhatsApp Plus Apk 18.40 – Download Latest Version Login Fixed 2025,” which suggests the site is presenting a counterfeit WhatsApp download while claiming to lure Facebook users. The domain appears on two public blocklists (PhishDestroy, PhishingDB) and has a Gridinsoft trust score of 0 / 100. AlienVault OTX references include 15 threat‑intel pulses, and VirusTotal reports 16 of 95 scanners flagging the host. The evidence indicates an active phishing infrastructure that may be used to harvest Facebook credentials or distribute malicious binaries. Defenders should immediately block the domain and its IP at perimeter firewalls and DNS resolvers, add the host to internal blocklists, and monitor for any outbound connections to the same IP range. Continuous threat‑intel feeds should be consulted for new indicators of compromise related to this infrastructure, and any email or web traffic containing the observed page title or the “WhatsApp Plus Apk” keyword should be inspected for potential abuse.