# PhishDestroy threat dossier — whats-vn-whatsapp.com.cn ================================================================ Fetched: 2026-06-28 22:19:16 UTC Canonical: https://phishdestroy.io/domain/whats-vn-whatsapp.com.cn/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 72/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 20/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Cluster25, CRDF, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Mimecast, Netcraft, OpenPhish, SOCRadar, Sophos, VIPRE, Webroot AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 43.226.17.60 (HK, Kwai Chung) ASN: AS64050 BGP Network Limited Hosting org: Hong Kong WAN Shou Network Technology Limited Registered: 2026-05-22 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: unknown Expires: 2036-04-29 Status: INVALID chain Fingerprint: 6b3e7ce56f30f7d3c56a5c24188b3b27bea58852dc1a4ff87080ce8ab87f2301 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-22 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-22 11:30:22 UTC (by PhishDestroy tracker) First reported: 2026-06-15 00:27:29 UTC (abuse notice filed) Last verified: 2026-06-28 20:20:36 UTC Neutralised: 2026-05-26 12:12:30 UTC Current status: taken down (registrar suspended or DNS dead) ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 20:56:32 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, whats-vn-whatsapp.com.cn, is a phishing site designed to impersonate WhatsApp and steal user login credentials. Visitors who enter their account details on this site risk having their WhatsApp accounts hijacked, personal messages exposed, or further targeted by fraudsters. The site may also distribute malware under the guise of a fake app update or verification process. Given the domain's focus on a widely used messaging platform, the potential impact is significant, particularly for users who reuse passwords across services. Analysis indicates this domain is malicious based on multiple technical indicators. It was created on May 22, 2026, and is hosted on an IP address (43.226.17.60) associated with a Hong Kong-based provider. VirusTotal reports that 20 out of 95 security vendors flag the domain as malicious, confirming its use in phishing campaigns. The domain appears on at least one security blocklist and was previously blocked by automated phishing detection systems. Its infrastructure, including the use of a .cn top-level domain, suggests an attempt to evade detection while targeting users familiar with WhatsApp's branding. If you visited whats-vn-whatsapp.com.cn or entered any information on the site, take immediate action to secure your account. First, change your WhatsApp password and enable two-step verification in the app settings. Check for any unauthorized devices logged into your account and log them out. Monitor your other accounts for suspicious activity, especially if you reused the compromised password. If you downloaded any files from the site, run a full scan on your device using updated security software. Report the incident to WhatsApp support and consider notifying contacts who may have received suspicious messages from your account. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 60ecbe0342a9ba5d0b348619d6817311 TLS cert SHA-256: 6b3e7ce56f30f7d3c56a5c24188b3b27bea58852dc1a4ff87080ce8ab87f2301 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/whats-vn-whatsapp.com.cn/ JSON API: https://api.destroy.tools/v1/check?domain=whats-vn-whatsapp.com.cn Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,064 domains (13,017 alive under monitoring, 158,549 confirmed takedowns/dead). Site: https://phishdestroy.io