one[.]message-whatapp[.]com[.]cn

One.message-whatapp.com.cn is a newly registered domain (created 28 July 2026) that resolves to the IPv4 address 192.197.113.111. The domain is delegated to the name servers ns1.kenpains.com and ns2.kenpains.com and was registered through 万商云集（成都）科技股份有限公司. VirusTotal scans show that 12 of 91 security vendors flag the domain as malicious, indicating a consensus of moderate to high confidence in a phishing classification. The domain appears on at least one public blocklist and has been explicitly blocked by the PhishDestroy filtering service, yet it remains listed as active in current observations.

No public SSL certificate information, HTTP status codes, or page titles have been disclosed, limiting insight into the content that is being served. The lack of a known Safe Browsing or OTX entry suggests that the domain has not yet been harvested by those feeds, but the existing vendor detections and blocklist inclusion provide sufficient evidence for immediate mitigation. Defenders should add the domain and its resolving IP address 192.197.113.111 to deny‑list rules across perimeter firewalls, DNS filtering, and endpoint protection suites.

Continuous monitoring of the hosting infrastructure and the two kenpains.com name servers is advised, as any change in resolution could indicate a shift in the underlying command‑and‑control infrastructure. Organizations that rely on WhatsApp‑related communications should educate users about unsolicited messages that reference the domain, and enforce MFA to reduce credential compromise risk. Because the registration details point to a Chinese corporate entity, threat‑intel teams may also consider cross‑referencing other domains registered by the same registrar for patterns of abuse.