whatsappwr[.]com[.]cn

Analysis of whatsappwr.com.cn indicates a brand‑impersonation campaign targeting Google users through a social‑media phishing vector. The domain resolves to the IP address 156.252.40.9, which is registered to AS9294 GNET INC. and geolocated in Hong Kong. Registration details show the domain was created by 四川域趣网络科技有限公司, and the authoritative name servers are ns1.363.hk and ns2.363.hk. No TLS certificate is present, meaning the site served traffic over plain HTTP, a characteristic often exploited to avoid certificate‑pinning checks.

The page title retrieved before the site was taken offline reads "WhatsApp 网页版 - 完整功能使用," suggesting the attackers attempted to lure victims with a familiar WhatsApp web interface while masquerading as a Google service. Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of reputational confidence. VirusTotal scans reported 19 positive detections out of 93 security vendors, confirming that multiple commercial scanners flag the domain as malicious. The domain is listed on at least one public blocklist and has been added to the PhishDestroy blocklist, indicating active mitigation by anti‑phishing services.

AlienVault OTX records show the domain appearing in two separate threat‑intel pulses, providing additional community‑sourced corroboration of its malicious nature. The current HTTP status is offline, limiting immediate interaction, but the infrastructure remnants remain observable. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated nameservers, and consider adding the IP address 156.252.40.9 to threat‑intelligence feeds. Organizations should also educate users about unsolicited requests that appear to originate from Google but redirect to unrelated services, reinforcing the need to verify URLs before credential entry.