app-web-whatsapp[.]he[.]cn

The domain app-web-whatsapp.he.cn is identified as a credential theft threat, specifically targeting users by impersonating the WhatsApp Web platform. This malicious domain aims to deceive victims into providing sensitive login credentials under the guise of an official WhatsApp Web interface. Such attacks can lead to unauthorized access to personal information and communications, posing significant privacy and security risks to individuals.

The domain was flagged by 18 out of 95 security vendors on VirusTotal, indicating a substantial recognition of its threat potential. It was registered through 成都垦派科技有限公司 and is currently offline following intervention by PhishDestroy. The domain was created with a Let's Encrypt SSL certificate, commonly used for both legitimate and malicious purposes. It was added to one known security blocklist, further corroborating its malicious intent. The domain's creation date is recorded as February 21, 2026, and it resolved to the IP address 168.76.144.201, located in Hong Kong under AS137951 ASLINE LIMITED.

Users who visited this domain should immediately change their passwords on all potentially compromised accounts, especially those related to WhatsApp. It is also advisable to enable multi-factor authentication where possible to add an extra layer of security. Monitoring account activity for any unauthorized access attempts is crucial. Additionally, users should remain vigilant against similar threats by ensuring URLs are verified before entering sensitive information and by keeping their security software up to date.