whatsappnk[.]com

This domain is flagged as an elevated-risk threat specializing in WhatsApp brand impersonation for credential theft. Analysis indicates the site mimics the official WhatsApp download portal, targeting users seeking legitimate software installations. The page title, 'WhatsApp官網下載 - WhatsApp最新各版本下载,' directly impersonates WhatsApp’s branding, increasing the likelihood of successful social engineering attacks against Mandarin-speaking users. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain whatsappnk.com is registered through GoDaddy.com, LLC, with a creation date of August 19, 2025. It resolves to the IP address 38.246.73.239, hosted by Evoxt Sdn. Bhd. (AS149440) in Malaysia. The SSL certificate is issued by Let's Encrypt (R12), a common choice for malicious infrastructure due to its low barrier to entry. Security vendors on VirusTotal flagged the domain at a rate of 21/95, while it appears on two blocklists: PhishDestroy and PhishingDB. The domain is currently offline, but its prior hosting and registration details remain relevant for historical threat analysis. Mitigation steps for this specific threat type include blocking the domain and associated IP address at the network perimeter. Organizations should deploy email and web filtering rules to prevent user access to the domain and its sub-resources. End-users should be educated on verifying the authenticity of download portals, particularly for widely impersonated brands like WhatsApp. Security teams are advised to monitor for credential harvesting attempts originating from similar infrastructure, as domains impersonating popular messaging platforms often serve as precursors to broader account takeover campaigns. Historical WHOIS and DNS records for this domain should be preserved for forensic analysis in the event of future incidents.