tv-xz-whatsapp[.]com[.]cn

The domain tv-xz-whatsapp.com.cn is identified as an elevated-risk threat, specifically a brand impersonation attack targeting WhatsApp users. The domain attempts to mimic the legitimate WhatsApp service, aiming to deceive users and potentially steal sensitive information.

Technical indicators reveal that the domain has been flagged by 24 out of 95 security vendors on VirusTotal. It is registered through 成都垦派科技有限公司 and resolves to the IP address 43.226.17.32, which is located in South Korea and operated by AS64050 BGP Network Limited. The domain was created on February 25, 2026, and currently appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, which is a common tactic to lend credibility to malicious sites.

As of the latest assessment, the domain tv-xz-whatsapp.com.cn has been taken offline, likely due to coordinated efforts by security agencies and blocklists such as PhishDestroy. However, the potential for residual risk remains, as users who have already interacted with the site may have been compromised. Security researchers recommend that affected users change their passwords and enable two-factor authentication on all relevant accounts. Continuous monitoring of the domain and associated infrastructure is advised to detect any resurgence of the threat.