whats-zms[.]vip

whats-zms.vip is an inactive domain that was observed hosting a brand‑impersonation campaign targeting WhatsApp users. The domain was registered on October 08 2025 through Gname.com Pte. Ltd. and uses four shared DNS resolvers (a.share-dns.com, a6.share-dns.com, b.share-dns.net, b6.share-dns.net). DNS resolution points to the IPv4 address 20.2.208.17, which belongs to AS8075 operated by Microsoft Corporation and geolocates to Hong Kong. No TLS certificate has been presented for the host, indicating that any HTTP service would be delivered over cleartext.

The site appears on a single security blocklist and has been explicitly blocked by PhishDestroy. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme malicious confidence. VirusTotal analysis shows that 15 of 95 scanned security vendors flagged the domain, corroborating its malicious nature. AlienVault OTX references the domain in 16 separate threat‑intel pulses, reinforcing its association with phishing infrastructure.

The campaign is classified as a brand‑impersonation scam, specifically masquerading as WhatsApp to lure credentials or other sensitive information. As of the report date the domain is taken offline, but the underlying IP and DNS infrastructure remain active and could be repurposed for future attacks. Defenders should add 20.2.208.17 and the four authoritative nameservers to network‑level deny lists, monitor the registrar Gname.com for new registrations, and ensure that web‑filtering solutions block any HTTP request to whats‑zms.vip. Continuous threat‑intel feeds should be consulted for any re‑activation, and endpoints should be advised to treat any unsolicited WhatsApp‑related links from this domain as malicious.