whatswgs[.]cc

This domain is flagged as an elevated-risk phishing site specializing in brand impersonation of WhatsApp. Analysis indicates the site mimics official WhatsApp functionality, specifically advertising a fraudulent "file export feature" to lure victims into disclosing credentials or downloading malicious payloads. The page title, "whatsapp(国际版)官网 - - 文件导出功能：方便保存与分享信息," directly targets Chinese-speaking users under the guise of a legitimate international version of the application. Infrastructure analysis reveals the domain was registered on October 11, 2025, through Dominet (HK) Limited, and resolves to IP address 91.204.227.158, hosted on AS205960 (HDTIDC LIMITED) in South Korea. VirusTotal detection rates show 19 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists: PhishDestroy and PhishingDB. The site employs a Let's Encrypt SSL certificate (R13) to create a false sense of legitimacy, a common tactic in phishing operations. Current status indicates the domain has been taken offline, though historical DNS records and cached content may still pose residual risks. Mitigation steps for this threat type include blocking the domain and its associated IP (91.204.227.158) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to newly registered domains impersonating trusted brands, particularly those using Let's Encrypt certificates. Security teams are advised to monitor for user reports of WhatsApp-related phishing attempts, especially those referencing "file export" or "international version" features. If compromised credentials are suspected, initiate password resets and enable multi-factor authentication for affected accounts. Historical WHOIS and DNS records should be preserved for forensic analysis in case of future incidents involving the same infrastructure.