app-sms-whatshktw[.]com

This domain, app-sms-whatshktw.com, is identified as a brand impersonation threat targeting WhatsApp users. The site mimics the official WhatsApp Web login portal, presenting itself as a legitimate platform for document transmission and account access. Analysis of the page title, "whatsapp 網頁版登入| 如何進行文件傳輸：支持多種格式," confirms the intent to deceive users into entering credentials or uploading sensitive files under false pretenses. No evidence of a cryptocurrency drainer or malware payload was observed, but the domain’s infrastructure and content align with credential harvesting tactics commonly employed in phishing campaigns.

Technical indicators reveal multiple red flags. The domain was registered on October 8, 2025, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 103.254.73.140, hosted under AS205960 (HDTIDC LIMITED) in South Korea, a network segment with a history of abusive activity. VirusTotal detections stand at 17 out of 95 security vendors, indicating moderate but consistent flagging across threat intelligence platforms. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and lacks an SSL certificate, further undermining its legitimacy. No entries were found in Google Safe Browsing at the time of analysis, though this does not preclude prior or future listings.

As of the latest assessment, app-sms-whatshktw.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. While the immediate threat is mitigated, residual risk persists due to the domain’s recent registration and potential for reactivation. Organizations and users are advised to block the domain and its resolving IP at the network level, monitor for credential reuse attempts, and educate end-users on recognizing impersonation tactics. Given the elevated risk profile, continuous monitoring of related infrastructure (e.g., sibling domains or shared hosting IPs) is recommended to preempt further abuse.