w-p-whatsapp[.]com[.]cn

Analysis of w-p-whatsapp.com.cn indicates a high‑risk brand‑impersonation campaign targeting WhatsApp users. The domain was registered on 21 Feb 2026 by 成都西维数码科技有限公司 and resolves to 154.221.8.155, an address announced as belonging to ASLINE LIMITED in Hong Kong (AS137951). Nameservers ns1.363.hk and ns2.363.hk are consistent with other malicious infrastructure observed in the region. The web server reports Nginx with HSTS and HTTP/3 enabled, but returns HTTP 403 for the tested request and presents an unknown SSL certificate. The page title “WhatsApp网页版” aligns with the declared brand target “whatsapp” and the scam type “Social Media Phishing”. VirusTotal scans have identified the domain as malicious in 23 of 93 security engines, and the site is already listed on PhishDestroy and a single additional blocklist. AlienVault OTX references the domain in two threat‑intel pulses. Gridinsoft assigns a trust score of 0 / 100, confirming its malicious reputation. Defenders should block both the domain and its resolved IP at perimeter firewalls, add the nameservers to DNS‑based deny lists, and monitor for any new sub‑domains registered by the same registrar. Continuous threat‑intel feeds should be consulted for updates, and incident response teams should treat any credential submissions to this site as compromised.