jzg-wswhatsapp[.]cc

This domain, jzg-wswhatsapp.cc, is flagged as a high-risk brand impersonation threat targeting Gmail users. Analysis indicates the site mimics legitimate WhatsApp Web functionality, presenting a page titled 'whatsapp登不上电脑- 如何进行文件共享：支持多种格式传输,' which suggests file-sharing capabilities while likely harvesting credentials or distributing malware. The domain does not appear to host a crypto drainer kit but instead focuses on phishing through fake login prompts or malicious file transfers, a common tactic for stealing email credentials and session tokens. Infrastructure analysis reveals critical technical indicators: the domain resolves to IP 103.99.210.170, hosted under AS205960 (HDTIDC LIMITED) in South Korea, with no SSL certificate present. It was registered on October 02, 2025, through Dominet (HK) Limited, a registrar frequently associated with fraudulent domains. VirusTotal detection shows 17 out of 95 security vendors flagging the domain, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on two security blocklists, PhishDestroy and PhishingDB, further corroborating its malicious nature. As of the latest assessment, jzg-wswhatsapp.cc has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a latent threat, as domains registered through high-risk registrars often reappear under similar names or IPs. Users who interacted with the site should invalidate any credentials entered and monitor for unauthorized access. Organizations are advised to block the domain, its resolving IP, and closely monitor related infrastructure for resurgence, particularly domains registered via Dominet (HK) Limited or hosted on AS205960.