lrx-wahst5pp[.]com

This domain, lrx-wahst5pp.com, presents itself as an official WhatsApp download portal targeting Chinese-speaking users. The site displays a fabricated page titled 'whats app 官网下载 - 办公室畅聊必备 |下载 iOS、Mac 和 PC 版 WhatsApp,' offering purported downloads for iOS, Mac, and PC versions of WhatsApp. Analysis indicates the site is designed to distribute malicious executables or collect user credentials under the guise of legitimate software distribution. The threat primarily involves brand impersonation, where users are tricked into downloading malware or entering sensitive information on a counterfeit platform that mimics the appearance and functionality of the official WhatsApp site.

Infrastructure analysis reveals the domain was registered on October 3, 2025, through registrar GKG.NET, INC. It resolves to the IP address 103.80.133.29, hosted on AS205960 (HDTIDC LIMITED) in South Korea. The domain is flagged by 18 out of 95 security vendors on VirusTotal, indicating a moderate to high level of detection. Additionally, it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (R12), which, while legitimate, does not mitigate the malicious intent of the domain. The creation date and registrar details suggest the domain was set up specifically for this campaign, with no prior legitimate use.

Users who visited lrx-wahst5pp.com should immediately disconnect the affected device from the network to prevent potential lateral movement or data exfiltration. Scan the device using updated antivirus or endpoint detection tools to identify and remove any downloaded malware. If credentials were entered on the site, reset passwords for WhatsApp and any other accounts where the same credentials may have been reused. Monitor financial and communication accounts for unauthorized activity. Report the incident to internal security teams or relevant authorities to aid in tracking and mitigating the threat. Avoid clicking on links or downloading files from unverified sources, and verify the authenticity of official download portals through direct navigation to the vendor's website.