123[.]bmt-whatsapp[.]com[.]cn

The domain 123.bmt-whatsapp.com.cn was registered on February 27, 2026 through 成都垦派科技有限公司 and is currently listed as offline. Infrastructure analysis shows the domain resolves to IP address 43.226.17.44, which is owned by BGP Network Limited (AS64050) and geolocated in the Republic of Korea. No TLS certificate is presented for the host, indicating that the service operates without encryption. The authoritative name servers are ns1.kenpains.com and ns2.kenpains.com, both of which are associated with the same registrar.

The page title returned from HTTP requests is "WhatsApp Web," aligning with the observed scam type of Social Media Phishing. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal scans report that 21 of 93 security vendors have flagged the domain, providing additional confidence in its malicious reputation. While the exact payload or credential‑harvesting mechanism has not been publicly disclosed, the combination of the WhatsApp‑related title, the lack of HTTPS, and the detection history strongly suggest a credential‑stealing campaign targeting WhatsApp users.

Defenders should continue to block DNS resolution for the domain, monitor outbound connections to the associated IP range, and ensure that email and web filters reject any URLs containing the domain or its sub‑domains. Because the site is offline, any ongoing campaigns may have shifted to new infrastructure; threat‑intel teams should watch for similarly patterned domains that reuse the same registrar, name servers, or IP ASN. Continuous re‑evaluation of blocklist status and VirusTotal detection counts is recommended to maintain up‑to‑date protection against this threat vector.