zh-whatsappweb-co[.]com[.]cn

Analysis of the domain zh-whatsappweb-co.com.cn indicates it was actively used for social media phishing targeting Facebook users, despite its page title displaying 'WhatsApp网页版' (WhatsApp Web). The domain was registered on November 18, 2025, through 四川域趣网络科技有限公司 and resolved to the IP address 156.252.43.99, hosted under AS9294 (GNET INC.) in Hong Kong. No SSL certificate was detected, increasing the risk of credential interception over unencrypted connections. Infrastructure checks reveal the domain was flagged by 20 of 95 security vendors on VirusTotal and appeared in 15 AlienVault OTX threat intelligence pulses, suggesting widespread detection.

It was also listed on one security blocklist and blocked by PhishDestroy. The nameservers ns1.363.hk and ns2.363.hk further link it to known malicious infrastructure. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The exact phishing mechanism remains unconfirmed due to the domain's current offline status, but the combination of the WhatsApp page title and Facebook brand targeting suggests an attempt to deceive users into entering credentials on a fraudulent login portal.

Defenders should treat this domain as compromised and prioritize blocking it at the DNS and network levels. Monitoring for re-registration or similar domains under the same registrar or hosting provider is recommended. No evidence of a phishing kit or additional scam categorization beyond 'Social Media Phishing' is available at this time.