whats-xti[.]vip

The domain whats-xti.vip was registered through Gname.com Pte. Ltd. on October 18, 2025. It resolves to the IPv4 address 20.2.67.40, which belongs to the Microsoft Corporation network (ASN 8075) and is geolocated in Hong Kong. The authoritative nameservers are a.share-dns.com, a5.share-dns.com, b.share-dns.net, and b5.share-dns.net, indicating use of a shared DNS service often observed in malicious hosting arrangements. No TLS certificate was observed for the domain, and the site is currently taken offline, precluding HTTP status verification.

VirusTotal analysis shows that 16 of 95 security vendors submitted detections for the domain, reflecting a moderate level of consensus among scanners that the host is malicious. The domain appears on a single public security blocklist and is actively blocked by PhishDestroy, confirming that at least one reputable anti‑phishing service has flagged it. AlienVault Open Threat Exchange reports the domain in four separate pulses, providing additional community‑sourced evidence of its use in threat campaigns. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, reinforcing the assessment that the infrastructure is wholly untrusted.

The campaign is classified as a brand impersonation targeting WhatsApp, as indicated by the supplied brand target field. No SSL/TLS, page title, or content snapshots have been captured, so the exact visual or functional characteristics of the site remain unknown. Given the convergence of vendor detections, blocklist listings, low trust score, and the association with a WhatsApp impersonation campaign, security teams should add the domain to deny‑list controls, monitor DNS queries for the associated IP address, and apply similar scrutiny to other domains that resolve to the same Microsoft‑hosted IP range.