app-webwhatsapp[.]com[.]cn

The domain app-webwhatsapp.com.cn was observed by multiple threat feeds and is currently offline. It was registered on October 19, 2025 through 四川域趣网络科技有限公司 and uses the Chinese nameservers ns1.365.hk and ns2.365.hk. DNS resolution points to IP address 154.55.236.62, which belongs to AS174, Cogent Communications, located in the United States. The site presented the page title “WhatsApp 网页版”, yet intelligence indicates the campaign is designed to impersonate Microsoft, classified as a social media phishing operation. The domain appears on one public security blocklist and is listed in 18 AlienVault OTX pulses, demonstrating recurring use in threat‑sharing communities.

Google Safe Browsing has flagged the host for social engineering, and PhishDestroy has actively blocked it. Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100, reinforcing the malicious intent. VirusTotal scans show 17 of 95 antivirus engines flagging the domain, confirming detection across multiple vendors. No TLS certificate was observed, leaving HTTP traffic unencrypted.

The combination of a Microsoft impersonation claim, a WhatsApp‑related page title, and the use of a Chinese‑registered infrastructure suggests a credential‑harvesting lure targeting users familiar with both services. Uncertainty remains regarding the exact payload delivered after the initial landing page, as no detailed content analysis is available. Defenders should add the IP 154.55.236.62 to network‑level deny lists, enforce blocklist rules for app-webwhatsapp.com.cn, and monitor for similar domains that share the 365.hk nameserver pair or the same registrar. Continuous ingestion of OTX pulses and VirusTotal alerts is recommended to capture future re‑activations of this infrastructure.