demo-whatapp[.]com[.]cn

Analysis of the domain demo-whatapp.com.cn indicates that it is currently active and was registered on July 15, 2026 through 成都垦派科技有限公司. The authoritative name servers are clint.ns.cloudflare.com and leah.ns.cloudflare.com, and DNS resolution points to the IP address 172.67.160.210, which is hosted on the Cloudflare network. VirusTotal has recorded 12 detections out of 91 scanned security vendors, confirming that the domain is being flagged by multiple AV engines as malicious. The threat type is classified as generic_phishing, placing it in a high‑risk category. No additional infrastructure details such as ASN or geographic location are provided beyond the Cloudflare edge address. The short registration window and immediate appearance of detections suggest an opportunistic campaign targeting users of the WhatsApp service, although the exact luring content has not been observed. Defenders should block DNS resolution to 172.67.160.210 for this hostname, add the domain to URL filtering and email gateway block lists, and monitor for any outbound connections to Cloudflare edge nodes that may be used for command‑and‑control. Continuous re‑scanning on VirusTotal is advised to capture any changes in detection rates. Because the domain is only three days old, threat intel sharing platforms should be updated promptly to improve early warning for other organizations.