call-whatsapp[.]com

This domain, call-whatsapp.com, poses a brand impersonation threat specifically targeting WhatsApp users through a fraudulent security verification page. The site displays the title 'whatsApp安全检测中心,' which translates to 'WhatsApp Security Detection Center,' a tactic designed to deceive users into believing they are interacting with an official WhatsApp security feature. Brand impersonation of this nature typically aims to harvest login credentials, personal information, or propagate malware under the guise of legitimate security checks. The use of non-Latin characters in the page title may also exploit users unfamiliar with such language constructs, increasing the likelihood of successful deception. Analysis of the domain's infrastructure reveals multiple indicators of malicious intent. The domain was registered on November 17, 2025, through Metaregistrar BV, a registrar frequently associated with high-risk domains. It resolves to the IP address 192.253.227.117, hosted in Hong Kong under AS152194 (CTG Server Limited), a network segment with a history of hosting phishing infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 20 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy. Notably, the domain lacks an SSL certificate, a red flag for any site purporting to handle sensitive user data. Users who visited call-whatsapp.com should take immediate remedial actions. If any credentials were entered, they must be changed immediately across all platforms where the same password was reused. Devices used to access the site should undergo a full antivirus scan to detect potential malware infections. Users are advised to monitor financial and communication accounts for unauthorized activity, as stolen credentials may be exploited for further attacks. To mitigate future risks, users should verify domain authenticity by cross-referencing official brand communications and avoid interacting with unsolicited security prompts, especially those hosted on newly registered or uncertified domains.