rmxqt-whatsapp[.]com[.]cn

The domain rmxqt-whatsapp.com.cn impersonates Microsoft in a Messenger phishing scheme. Detected on its creation date, April 6, 2026, it was swiftly flagged by PhishDestroy and one other vendor on VirusTotal. Despite being taken offline, its initial impact underscores the rapid deployment of phishing tactics exploiting brand trust.

This domain was registered through 万商云集（成都）科技股份有限公司 and hosted on an IP managed by Cloudflare, Inc., located in Canada. The phishing site used Let's Encrypt for its SSL certificate, which is a common choice for attackers due to its free and automated issuance. The platform risk score of 71/100 indicates a significant threat level, suggesting sophisticated phishing methods designed to harvest user credentials.

PhishDestroy's early detection highlights the efficiency of its threat intelligence pipeline, capturing threats during the critical window before widespread antivirus database updates. This proactive approach is crucial in mitigating phishing attacks that exploit the latency in traditional detection systems. The domain's swift takedown demonstrates effective collaboration between security entities and hosting providers to neutralize threats.