drk-whatsapp[.]hk[.]cn

This domain, drk-whatsapp.hk.cn, is identified as a high-risk credential theft operation specifically impersonating WhatsApp Web. Analysis confirms the domain was actively harvesting user login credentials by mimicking the legitimate WhatsApp Web interface. As of the latest assessment, the domain has been taken offline, though residual risks may persist for users who previously interacted with it. Infrastructure analysis reveals the domain was registered through 万商云集（成都）科技股份有限公司 on June 02, 2026, an anomalous creation date suggesting potential use of falsified registration details. The domain resolved to the IP address 52.184.98.194, hosted under AS396982 (Google LLC) in Hong Kong. Security vendor assessments flagged the domain as malicious, with 25 of 95 VirusTotal vendors detecting it as a threat. Google Safe Browsing classified it as phishing, and it appeared on at least one security blocklist. The SSL certificate was issued by Let's Encrypt (YR1), a common tactic to lend superficial legitimacy to fraudulent sites. Current status indicates the domain is offline, reducing immediate exposure risks. However, organizations and users should remain vigilant for similar impersonation attempts targeting messaging platforms. Recommended actions include blocking the domain and its associated IP address (52.184.98.194) at the network level, conducting retrospective log analysis to identify prior interactions, and educating users on recognizing credential theft tactics. Monitoring for newly registered domains with similar naming patterns (e.g., WhatsApp-themed subdomains) is advised to preempt future threats. Users who accessed the domain should reset credentials for any accounts potentially exposed during the interaction.