whattisapp[.]com

Analysis of the domain whattisapp.com, observed as offline on 23 July 2026, identifies a brand‑impersonation campaign targeting WhatsApp users. The site was registered on 3 November 2025 through NameSilo, LLC and resolves to the IPv4 address 57.144.245.32, which is allocated to AS32934 owned by Facebook, Inc. in Germany. No SSL certificate is presented, indicating that any client connection would be unencrypted. The page title returned from the server is the Hebrew phrase “שיתוף ב‑WhatsApp”, directly referencing the targeted brand and reinforcing the impersonation intent.

Threat‑intelligence aggregators have flagged the domain: fifteen of ninety‑five VirusTotal scanners raise alerts, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the host, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme suspicion. The nameserver configuration uses three dnsowl.com resolvers (ns1, ns2, ns3), a pattern observed in other malicious deployments. Current evidence confirms the domain’s intent to masquerade as a WhatsApp sharing service, yet the exact payload or credential‑harvesting mechanism remains unknown because the site is offline and no content has been captured.

The lack of TLS, combined with the low trust score and multiple vendor detections, suggests a high probability of malicious activity. Defenders should add whattisapp.com to deny lists, enforce outbound filtering for connections to its IP address, and monitor for any new domains registered with the same registrar, nameserver set, or similar Hebrew‑language page titles referencing WhatsApp. Continuous observation of AS32934 traffic for anomalous patterns is also advised, as the infrastructure may be leveraged for additional impersonation campaigns.