app-whats-whatsappweb[.]com[.]cn

This domain carries a high risk level due to brand impersonation, specifically targeting Microsoft by posing as a WhatsApp Web login page. PhishDestroy identified this as a sophisticated phishing attempt designed to harvest credentials from unsuspecting users. The site's title, "WhatsApp 网页版," is a clear attempt to deceive users into believing they are accessing a legitimate service.

The technical indicators paint a grim picture. VirusTotal reports 19 out of 95 security vendors flagging this domain as malicious. It appears on 2 security blocklists and is flagged by Google Safe Browsing as phishing. The domain was registered on October 19, 2025, through 四川域趣网络科技有限公司, and resolves to IP address 154.55.240.36. No SSL certificate was found, further indicating malicious intent. AlienVault OTX notes its presence in 18 threat intelligence pulses. The domain is currently offline, but its brief activity period underscores the need for vigilance.

To protect against such threats, users should always verify URLs before entering credentials, especially for services like WhatsApp Web. Enable multi-factor authentication on all accounts, and use a password manager to avoid reusing credentials. Report any similar domains to security teams and block the IP 154.55.240.36 at the network level. PhishDestroy recommends maintaining up-to-date threat intelligence feeds to catch new impersonation domains early.