whats-six[.]vercel[.]app

This domain is flagged as a high-risk WhatsApp credential phishing site. Analysis indicates the infrastructure is designed to harvest login credentials from users attempting to access a fraudulent WhatsApp web interface, specifically targeting Chinese-speaking victims as evidenced by the page title 'Whatsapp网页版登录 - WhatsApp网页版.' Infrastructure analysis reveals the domain was registered on March 26, 2026, through Vercel Inc. and resolves to IP address 64.29.17.3, hosted in the United States. The domain appears on one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WR1), a common practice among phishing sites to appear legitimate. The domain remains active as of the latest verification. Mitigation steps include immediate blocking of the domain and IP address across network security controls. Security teams should prioritize scanning for indicators of compromise, including the domain, IP, and SSL certificate fingerprint. User awareness training should emphasize verifying URLs before entering credentials, particularly for web-based messaging services. Organizations should monitor for unusual authentication attempts originating from internal networks and enforce multi-factor authentication for all messaging platforms.