app-tap-whatsappweb[.]com[.]cn

This domain, app-tap-whatsappweb.com.cn, is identified as a brand impersonation threat targeting WhatsApp users. Analysis indicates the site mimics the official WhatsApp Web portal, presenting a login interface under the title 'WhatsApp網頁版' to deceive users into entering credentials. No crypto drainer or malware payloads were explicitly linked to this domain, but the impersonation tactic aligns with credential harvesting campaigns commonly observed in phishing operations. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 21 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through 四川域趣网络科技有限公司 (Sichuan Yugu Network Technology Co., Ltd.) on October 24, 2025, and resolves to the IP address 80.97.160.74, hosted under AS48753 (AVA HOST SRL) in Moldova. The domain lacks an SSL certificate, increasing the likelihood of interception during credential transmission. It appears on one security blocklist and was blocked by PhishDestroy, though no Google Safe Browsing (GSB) entries were recorded at the time of analysis. The domain has since been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential vector for future campaigns, particularly given the registrar's history of hosting impersonation domains. Users who accessed the site prior to its takedown should assume credential compromise and initiate password resets for associated accounts. Organizations are advised to monitor network logs for connections to 80.97.160.74 and implement domain-based blocking for app-tap-whatsappweb.com.cn to prevent residual access attempts. The elevated risk classification stems from the domain's targeted impersonation of a widely used messaging platform, combined with its low detection coverage on initial deployment.