# PhishDestroy threat dossier — web.lps-web-whatsapp.com.cn ================================================================ Fetched: 2026-06-20 20:16:30 UTC Canonical: https://phishdestroy.io/domain/web.lps-web-whatsapp.com.cn/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 65/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 18/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Mimecast, Netcraft, OpenPhish, SOCRadar, Sophos, VIPRE, Webroot Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.104.101.57 (JP, Tokyo) ASN: AS63949 Akamai Connected Cloud Hosting org: Linode Registered: 2026-05-21 Page title: WhatsApp 网页版 | 扫码认证安全登入 HTTP response: 530 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-08-18 Status: INVALID chain Fingerprint: 001003695f10a2c0801b7215773f2eb7fda0f1d73b4073f7caa5a95078c52b6d Subject Alternative Names (related infrastructure — often same operator): - app.aps-web-whatsapp.com.cn - app.hks-web-whatsapp.com.cn - app.ipo-web-whatsapp.com.cn - app.lps-web-whatsapp.com.cn - app.web-hkk-whatsapp.com.cn - app.web-ip-whatsapp.com.cn - app.web-ipo-whatsapp.com.cn - app.web-zhhk-whatsapp.com.cn - app.web-zhzh-whatsapp.com.cn - app.wps-web-whatsapp.com.cn - web.aps-web-whatsapp.com.cn - web.hks-web-whatsapp.com.cn - web.ipo-web-whatsapp.com.cn - web.web-hkk-whatsapp.com.cn - web.web-ip-whatsapp.com.cn ... +4 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-21 17:30:06 UTC (by PhishDestroy tracker) First reported: 2026-06-15 06:49:02 UTC (abuse notice filed) Last verified: 2026-06-20 20:20:34 UTC Neutralised: 2026-05-22 07:09:48 UTC Current status: taken down (registrar suspended or DNS dead) ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-18 16:52:40 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain poses a significant threat as it impersonates the WhatsApp login page, attempting to trick users into revealing their sensitive information. The site was flagged by 18 out of 95 security vendors on VirusTotal, and its SSL certificate is issued by Let's Encrypt, which may give it a false sense of security. It was created on May 21, 2026, and resolves to the IP address 172.104.101.57, indicating a potentially malicious intent behind its creation. PhishDestroy identifies web.lps-web-whatsapp.com.cn as a generic phishing site, with an elevated risk level, and it currently appears on one security blocklist. The domain has been taken offline, but users who may have visited it before should be cautious and verify their accounts for any suspicious activity. The fact that it has been flagged by multiple security vendors and appears on a blocklist suggests that it is indeed a malicious site, and users should exercise extreme caution when dealing with similar domains in the future. If a user has visited this domain, they should immediately check their account for any unauthorized activity and change their login credentials as a precautionary measure. It is also essential to be vigilant when clicking on links or entering sensitive information online, as phishing sites like web.lps-web-whatsapp.com.cn can be highly deceptive and may lead to severe consequences, including identity theft and financial loss. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 001003695f10a2c0801b7215773f2eb7fda0f1d73b4073f7caa5a95078c52b6d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/web.lps-web-whatsapp.com.cn/ JSON API: https://api.destroy.tools/v1/check?domain=web.lps-web-whatsapp.com.cn Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 166,973 domains (13,284 alive under monitoring, 153,371 confirmed takedowns/dead). Site: https://phishdestroy.io