web[.]whatsapp-net[.]com[.]cn

This domain, web.whatsapp-net.com.cn, is flagged for brand impersonation targeting WhatsApp, a widely used messaging platform. Analysis indicates the site mimics the legitimate WhatsApp Web interface, as evidenced by its page title, 'WhatsApp Web,' designed to deceive users into entering sensitive credentials. The threat type is classified as credential harvesting through brand spoofing, a common tactic in phishing campaigns to exploit user trust in recognized brands. Infrastructure analysis reveals the domain was registered on December 28, 2025, through 四川域趣网络科技有限公司, a registrar based in China. It resolves to the IP address 156.252.40.30, located in Hong Kong under AS9294 (GNET INC.). The domain appears on one security blocklist and is detected by 17 out of 95 security vendors on VirusTotal, indicating moderate but not widespread detection. Notably, the domain lacks an SSL certificate, a red flag for secure communication and a common characteristic of low-effort phishing infrastructure. No association with known drainer kits or advanced evasion techniques is observed in available intelligence. As of the latest assessment, web.whatsapp-net.com.cn has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the elevated risk level persists due to the domain's recent creation date and the potential for re-emergence under similar infrastructure. Users and organizations are advised to monitor for related domains using the same registrar or IP range, as threat actors often rotate infrastructure to evade detection. Proactive measures, such as blocking the IP 156.252.40.30 and implementing domain-based filtering for newly registered lookalike domains, are recommended to mitigate residual risk. Credential monitoring and user education on recognizing brand impersonation remain critical defensive strategies.