app-rxd-whatshktw[.]com

This domain, app-rxd-whatshktw.com, poses a brand impersonation threat specifically targeting WhatsApp users through deceptive web content. The page title, "whatsapp有網頁版的嗎- 如何使用快捷鍵提陞傚率：快速操作指南," suggests an attempt to lure users into engaging with fraudulent material under the guise of legitimate WhatsApp functionality, such as web-based access or productivity shortcuts. Such impersonation tactics are commonly employed to harvest credentials, distribute malware, or manipulate users into disclosing sensitive information through social engineering techniques. The domain’s content, presented in Chinese, indicates a targeted campaign aimed at Mandarin-speaking users, increasing the risk of localized exploitation. Analysis indicates this domain was registered on October 08, 2025, through Dominet (HK) Limited, and resolves to the IP address 91.204.227.173, hosted within the KR region under AS205960 (HDTIDC LIMITED). Security vendors have flagged the domain as malicious, with 14 out of 95 VirusTotal engines detecting it as a threat. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, further corroborating its malicious intent. The absence of an SSL certificate is another red flag, as it exposes users to unencrypted data transmission, increasing the risk of interception or manipulation during interactions with the site. Users who visited app-rxd-whatshktw.com should take immediate action to mitigate potential risks. If credentials or personal information were entered, reset passwords for WhatsApp and any other accounts where the same credentials may have been reused. Conduct a full system scan using updated security tools to detect and remove any malware that may have been downloaded. Monitor financial and communication accounts for unauthorized activity, and enable multi-factor authentication where available. Organizations should update their security blocklists to include this domain and its associated IP address (91.204.227.173) to prevent further access attempts from internal networks. Awareness of such impersonation tactics should be reinforced through user training, particularly regarding the risks of interacting with unverified web pages claiming to offer official brand services.