web[.]i-whatsapp[.]com[.]cn

This domain, web.i-whatsapp.com.cn, poses a brand impersonation threat designed to deceive users into believing they are accessing the legitimate WhatsApp Web service. The site mimics the official WhatsApp Web interface, potentially tricking visitors into entering credentials, personal information, or downloading malicious content. Given the domain's design to replicate a trusted platform, users may unknowingly expose sensitive data to unauthorized third parties, leading to account compromise or further exploitation. Analysis indicates the domain was registered on January 5, 2026, through 成都西维数码科技有限公司, a registrar based in China. It resolved to the IP address 154.221.8.129, located in Hong Kong under AS137951 (ASLINE LIMITED). The domain has been flagged by 21 out of 95 security vendors on VirusTotal, confirming its malicious nature. Additionally, it appears on one security blocklist and was previously blocked by network-level protections. The absence of an SSL certificate further increases the risk, as any data transmitted would lack encryption, making interception easier for threat actors. If a user visited web.i-whatsapp.com.cn, immediate action is required to mitigate potential compromise. First, disconnect the device from the network to prevent further data exfiltration. Reset any credentials entered on the site, particularly WhatsApp or email passwords, using a separate, trusted device. Scan the affected device with updated security tools to detect and remove any malware or unauthorized applications. Monitor linked accounts for suspicious activity, such as unauthorized logins or messages sent without consent. Users should also report the domain to their organization’s security team or relevant authorities to aid in broader threat containment efforts.