m[.]wsp-wswhatsapp[.]cc

This domain is flagged for elevated-risk brand impersonation targeting Facebook, specifically leveraging WhatsApp-themed content to deceive users. The page title, "whatsapp官网登录入口| 如何使用状态功能：分享生活点滴," suggests an attempt to mimic official WhatsApp login portals, a common tactic in credential harvesting campaigns. Analysis indicates the domain is designed to exploit trust in Facebook-owned platforms, likely to capture login credentials or distribute malicious payloads under the guise of legitimate functionality. Infrastructure analysis reveals the domain was registered on October 02, 2025, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 103.80.133.84, hosted under AS205960 (HDTIDC LIMITED) in South Korea, a network with a history of hosting malicious infrastructure. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data. Security vendor detections on VirusTotal stand at 17/95, with blocklist appearances on PhishDestroy and PhishingDB, further corroborating its malicious classification. The domain is currently offline, though historical activity suggests it may resurface under similar or altered infrastructure. Mitigation steps for this threat type include blocking the domain and its associated IP (103.80.133.84) at the network perimeter to prevent access. Organizations should monitor for indicators of compromise, such as unusual login attempts or unauthorized access to Facebook or WhatsApp accounts, particularly from users who may have interacted with the domain. End-user education should emphasize verifying domain authenticity before entering credentials, especially for platforms like WhatsApp or Facebook, where impersonation is prevalent. Security teams are advised to review logs for connections to the domain or IP and correlate with other indicators of phishing activity, such as sudden spikes in failed login attempts or anomalous account behavior.