crztd669web[.]ch-za-whatsappo[.]com

This domain presents an active phishing threat designed to impersonate official WhatsApp authentication portals. Analysis indicates the site mimics legitimate WhatsApp login interfaces, likely targeting users through social engineering tactics to harvest account credentials, payment details, or personal information. The domain's infrastructure and page title explicitly reference WhatsApp, suggesting a targeted campaign against users of the messaging platform. Infrastructure analysis reveals multiple high-risk indicators. The domain crztd669web.ch-za-whatsappo.com was registered on June 15, 2026, through Dominet (HK) Limited, with an unusually future creation date that may indicate domain generation algorithm usage or registry manipulation. It currently resolves to IP address 52.184.98.194 and employs a Let's Encrypt SSL certificate, which while providing encryption, does not validate legitimacy. Google Safe Browsing has classified this domain under SOCIAL_ENGINEERING, and VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. The domain remains active as of this report. Users who have visited crztd669web.ch-za-whatsappo.com should immediately cease all interaction and perform the following actions: reset credentials for any accounts entered on the site, particularly WhatsApp and associated email accounts; scan local devices for malware using updated security tools; monitor financial statements for unauthorized transactions; and report the incident to their organization's security team or relevant authorities. If authentication tokens or session cookies were exposed, users should revoke active sessions from their WhatsApp account settings. Organizations should block the domain and IP address at perimeter security controls and update endpoint detection rules to prevent access.