web-zh-whatsapp[.]com[.]cn

This domain, web-zh-whatsapp.com.cn, has been identified as a credential theft operation specifically targeting WhatsApp users. The site employs a sliding verification mechanism (滑动验证) commonly associated with fake login portals designed to harvest account credentials. As of the latest assessment, the domain has been taken offline, though prior activity suggests an active campaign to impersonate WhatsApp authentication flows. Analysis of the domain’s infrastructure reveals multiple elevated-risk indicators. The domain was registered on February 21, 2026, through 四川域趣网络科技有限公司, a registrar frequently associated with high-risk registrations. It resolves to the IP address 156.239.15.48, hosted under AS154321 (CORENET CLOUD SDN. BHD.) in Hong Kong. The SSL certificate, issued by Let’s Encrypt (R12), provides minimal assurance, as it is commonly exploited in phishing operations. Security vendors have flagged this domain in 18 of 95 VirusTotal scans, and it appears on at least one security blocklist. The page title, 滑动验证, further corroborates the credential theft intent, as this technique is often used to bypass automated detection while capturing user input. Given the domain’s current offline status, immediate threats to end-users have been mitigated. However, the infrastructure remains a latent risk, as domains registered through high-risk registrars and hosted on bulletproof providers are frequently reactivated. Organizations and individuals are advised to block the domain and its associated IP (156.239.15.48) at the network level. End-users should be educated on recognizing sliding verification prompts as a red flag for credential theft attempts. Security teams are recommended to monitor for renewed activity under the same registrar or hosting provider, as threat actors often reuse infrastructure for subsequent campaigns.