app-qke-whatshktw[.]com

The domain app-qke-whatshktw.com was registered on October 08, 2025 through Dominet (HK) Limited and is currently offline. Infrastructure analysis shows the domain resolves to IP address 103.99.210.69, which belongs to AS205960 HDTIDC LIMITED and is geolocated in South Korea. No SSL certificate is present, and the site was served without HTTPS. The authoritative nameservers listed are ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainname.

The page title observed during the brief capture period was "whatsapp網頁登錄入口| 如何使用快捷鍵提陞聊天傚率：快速操作," indicating a possible attempt to lure users with a Chinese-language login prompt. The domain impersonates the Facebook brand and is classified as a brand‑impersonation campaign. Detection footprints include appearance on one security blocklist and inclusion in seventeen AlienVault OTX threat‑intelligence pulses. Reputation services rate the domain poorly, with Scamadviser assigning a trust score of 1 out of 100 and Gridinsoft assigning a score of 0 out of 100.

VirusTotal analysis shows that sixteen of ninety‑five security vendors flagged the domain, confirming malicious behavior. The domain is also blocked by the PhishDestroy filtering service. While the exact phishing kit or credential‑harvesting mechanism has not been observed, the combination of a brand‑impersonation label, low trust scores, multiple vendor detections, and inclusion in threat‑intel feeds suggests a high likelihood of credential‑theft activity targeting Facebook users. Defenders should continue to block the domain at network perimeters, update URL filtering lists to include the domain and its associated IP, monitor for any resurgence of the domain or related hostnames, and advise users to verify the authenticity of Facebook login pages before entering credentials.