whhatsapp.vip
Appeared in the .vip zone on Friday, September 4, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
whhatsapp.vip is a character-doubling typosquat of whatsapp.com that redirects visitors to api.whatsapp.com/send with an attacker-controlled number (+1 430 294 4099) and a pre-filled 'Start verification' message posing as WhatsApp 'Customer Service' — the standard shape of a WhatsApp verification-code/account-takeover lure, with the deceptive domain name doing the impersonation and the real WhatsApp destination supplying the credibility.
The domain whhatsapp.vip is a typosquat of WhatsApp (one letter transposition) registered at a retail registrar with free DNS (dnsowl.com), redirecting to WhatsApp's legitimate API endpoint. This is a classic brand-squat setup: the typo name combined with off-brand nameservers and redirect infrastructure indicates the domain's only purpose is to deceive visitors into clicking a misspelled domain, likely for affiliate or click-fraud purposes.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, September 4, 2026
Same data as JSON: /api/zone/domain/whhatsapp.vip. This page is not indexed by search engines and does not link to the site it describes.