gouidekdc[.]eu[.]cc

This domain, gouidekdc.eu.cc, is flagged as an elevated-risk phishing site specifically targeting WhatsApp credentials. Analysis indicates the threat type is credential harvesting, designed to deceive users into submitting login details through a fraudulent WhatsApp Web interface. The page title explicitly mimics the legitimate service, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Infrastructure analysis reveals the domain resolves to IP address 103.143.239.125, hosted under AS138152 (YISU CLOUD LTD) with a geolocation in the United States. The domain was registered through Gname.com Pte. Ltd. on October 13, 1997, though the creation date may reflect registry artifacts rather than active malicious use. Detection metrics show 20 out of 95 security vendors on VirusTotal flagged the domain as malicious, while a single security blocklist (PhishDestroy) has already incorporated it into its denylist. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to lend superficial legitimacy to phishing infrastructure. Mitigation against this threat requires immediate domain blocking at the network perimeter and endpoint levels. Organizations should deploy indicators of compromise (IOCs) including the domain gouidekdc.eu.cc and IP 103.143.239.125 into security controls. User awareness training should emphasize verifying URLs before entering credentials, particularly for messaging platforms. Given the domain's current offline status, continuous monitoring for reactivation or domain reuse under similar naming conventions is recommended. Security teams should also investigate potential lateral movement if any internal systems accessed the site prior to takedown.