mobile-whatapp[.]com[.]cn

Analysis of the domain mobile-whatapp.com.cn indicates it is an active phishing infrastructure targeting users of a widely recognized messaging platform. Registered on July 15, 2026, through 万商云集（成都）科技股份有限公司, the domain resolves to the IP address 172.67.148.26 and utilizes Cloudflare nameservers (clint.ns.cloudflare.com and leah.ns.cloudflare.com). As of July 17, 2026, six out of ninety-one security vendors on VirusTotal have flagged this domain as malicious, suggesting detection of phishing-related activity. The domain name itself contains a misspelling of 'WhatsApp,' a common tactic to deceive users into believing they are accessing a legitimate service. While the exact content of the site has not been analyzed, the combination of a brand-adjacent name, recent registration, and security vendor detections strongly supports classification as a high-risk phishing domain. Infrastructure analysis reveals the use of Cloudflare services, which may obscure the true hosting origin and complicate takedown efforts. Defenders should treat this domain as active and malicious, blocking resolution at the DNS level and monitoring for connections to the associated IP address. Further investigation into the site's content and any linked infrastructure is recommended to assess the full scope of the campaign. No additional brand-specific details or scam categorization beyond the domain name are currently available.