bd-hj-whatsapp[.]com[.]cn

This domain is classified as a high-risk credential phishing threat targeting WhatsApp users. Analysis indicates the infrastructure was specifically designed to deceive users into submitting account credentials through a fraudulent Chinese-language interface mimicking the official WhatsApp platform. The page title, 'WhatsApp | 安全可靠的免费私密消息和通话,' directly translates to 'WhatsApp | Secure and reliable free private messages and calls,' a clear attempt to establish legitimacy with Mandarin-speaking users. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain bd-hj-whatsapp.com.cn was registered on February 25, 2026, through 成都垦派科技有限公司, a registrar frequently associated with phishing operations. It resolves to the IP address 43.226.17.32, hosted on AS64050 (BGP Network Limited) in South Korea. The domain is currently offline but was previously flagged by 20 out of 95 security vendors on VirusTotal, blocked by at least one security blocklist, and designated as phishing by Google Safe Browsing. The SSL certificate, issued by Let's Encrypt (R12), was likely used to lend a false sense of security to potential victims. Mitigation against this threat requires a multi-layered approach. Network-level protections should include blocking the domain and its associated IP (43.226.17.32) at firewalls and DNS resolvers. Organizations should monitor for connections to AS64050 and alert on any attempts to access the domain. End-user education should emphasize verifying domain authenticity, particularly for login pages, and recognizing the risks of non-official WhatsApp portals. Given the domain's Chinese-language targeting, localized security awareness campaigns are recommended for Mandarin-speaking user bases. Incident response teams should treat any credentials submitted to this domain as compromised and initiate password resets and multi-factor authentication reviews for affected accounts.