web-whsatsapp[.]com

The domain web-whsatsapp.com is associated with a generic phishing threat. It appears to be a spoof of the legitimate WhatsApp brand, potentially aiming to trick users into divulging sensitive information such as login credentials or personal data. No specific drainer kit has been identified, but the domain's infrastructure and activity suggest a targeted phishing campaign.

Infrastructure analysis reveals that web-whsatsapp.com is registered through Gname.com Pte. Ltd. and resolves to the IP address 134.122.169.21, located in Hong Kong (AS152194 CTG Server Limited). The domain was created on August 25, 2025, and has been flagged by 19 out of 95 security vendors on VirusTotal. It also appears on one security blocklist and was blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, which is a common, free certificate provider often used by malicious actors to gain user trust.

As of the latest assessment, the domain is currently offline, which may indicate that it has been taken down by security measures or abandoned by the threat actors. However, the offline status does not eliminate the risk entirely, as such domains can be reactivated. Users should remain vigilant and avoid visiting the domain or clicking on any links associated with it. Network administrators are advised to update their security policies and blocklists to include this domain to prevent any potential reactivation risks.