wa[.]links-whatapp[.]com[.]cn

The domain wa.links-whatapp.com.cn was registered on July 28, 2026 by the organization 万商云集（成都）科技股份有限公司 and is currently active. DNS resolution points to the single IPv4 address 192.197.113.111, and the domain is served by the authoritative name servers ns1.kenpains.com and ns2.kenpains.com. Threat intelligence feeds indicate that the domain has been added to one security blocklist and is actively blocked by the PhishDestroy service, suggesting that defensive controls are already aware of its malicious intent.

VirusTotal analysis shows that nine out of ninety‑one scanning engines have flagged the domain, reinforcing the suspicion of abuse. No additional public evidence such as page titles, SSL certificates, or HTTP response codes is available, so the exact payload or credential‑harvesting mechanisms remain unconfirmed. The limited detection surface—primarily the blocklist entry, PhishDestroy block, and the nine VirusTotal detections—provides a clear indicator set for security operations.

Defenders should prioritize the domain for immediate blocking at network perimeter devices, DNS resolvers, and endpoint protection solutions. Continuous monitoring of the associated IP address 192.197.113.111 for any new activity is advised, as well as periodic re‑query of VirusTotal and other reputation services to capture potential changes in detection counts. Given the recent creation date and the presence of an established registrar, the infrastructure appears to be a purpose‑built phishing platform, and proactive containment will reduce the risk of credential compromise for users who may be targeted with fake login prompts.