wwh[.]news

This domain, wwh.news, is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Telegram brand. The site presents a page titled “WWH‑CLUB — Email Verification” and returns HTTP 200, indicating a fully operational front‑end designed to lure victims into providing credentials or cryptocurrency payments.

Infrastructure analysis shows the domain resolves to IP 185.111.111.155, which is hosted in Germany and assigned to AS212238 (Datacamp Limited). The authoritative nameservers are kiki.bunny.net and coco.bunny.net, and the MX records point to mx1.spacemail.com and mx2.spacemail.com, both with priority 0. The domain was registered on 13 March 2026 through NiceNIC International Group Co., Limited, and uses a Let’s Encrypt certificate (E8).

Threat intelligence indicates the domain appears in nine AlienVault OTX pulses and has a Gridinsoft trust score of 0 / 100. VirusTotal reports that two of ninety‑five security vendors flagged the domain, and it is listed on one security blocklist. PhishDestroy has also blocked the domain, reinforcing the consensus that it is being used for malicious purposes. At present, the exact phishing kit or malicious payload employed by the campaign has not been publicly disclosed, leaving the full scope of the threat uncertain.

Defenders should proactively block resolution of wwh.news at the network perimeter and add the domain to email filtering rules that reject messages originating from its MX hosts. Continuous monitoring of DNS changes and any new SSL certificate issuance is advised, as the infrastructure may be repurposed. Incident response teams should treat any communications referencing the site as potentially fraudulent and advise users to avoid providing Telegram credentials or cryptocurrency payments.