app-lzd-whatshktw[.]com

The domain app-lzd-whatshktw.com has been identified as a brand impersonation threat targeting WhatsApp users. Analysis confirms the domain is currently offline, though prior activity suggests an intent to deceive users through fraudulent web interfaces mimicking legitimate WhatsApp services. The specific threat type involves brand impersonation, likely aimed at credential theft or unauthorized account access under the guise of WhatsApp functionality. Infrastructure analysis reveals the domain was registered on October 08, 2025, through Dominet (HK) Limited and resolves to the IP address 91.204.227.152, hosted under AS205960 (HDTIDC LIMITED) in South Korea. Security vendors on VirusTotal flagged the domain in 17 of 95 scans, while one security blocklist has already listed it. The page title, "WhatsApp web- 如何進行多方通話設置：輕松實現團隊會議," directly references WhatsApp’s multi-party calling feature, a common tactic to lure users into interacting with malicious content. Notably, the domain lacks an SSL certificate, further indicating substandard or intentionally deceptive infrastructure. Current status indicates the domain has been taken offline, though residual risks remain for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and its associated IP (91.204.227.152) at the network level. Users should verify all WhatsApp-related communications through official channels and enable multi-factor authentication to mitigate credential theft risks. Monitoring for similar domains registered under the same registrar (Dominet (HK) Limited) or resolving to the same IP range is recommended for proactive threat detection.