app-gkc-whatsappcc[.]com

The domain app-gkc-whatsappcc.com has been identified as a phishing site specializing in brand impersonation, specifically targeting Facebook’s WhatsApp service. Analysis confirms the domain is designed to deceive users by presenting a fraudulent page titled 'whatsapp国内版- 如何调整消息隐私设置：保障聊天安全,' which mimics legitimate WhatsApp privacy settings. The domain is currently offline, but prior activity indicates it was actively used for credential harvesting or social engineering attacks under the guise of a trusted platform. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited on October 05, 2025, and resolved to the IP address 103.99.210.23, hosted under AS205960 HDTIDC LIMITED in South Korea. The domain appears on two security blocklists and has been flagged by 17 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious intent. Notably, the domain lacks an SSL certificate, a common red flag for phishing sites as it exposes user interactions to interception. The page title and content were tailored to exploit trust in WhatsApp’s brand, likely targeting Chinese-speaking users based on the language used. As of the latest assessment, app-gkc-whatsappcc.com has been taken offline, reducing immediate risk to end users. However, organizations and individuals should remain vigilant, as domains of this nature often reappear under different names or IPs. Recommended actions include blocking the domain and its associated IP (103.99.210.23) at the network level, monitoring for similar impersonation attempts, and educating users on recognizing phishing indicators such as missing SSL certificates, unusual domain names, and unsolicited requests for credentials. Security teams should also review logs for any prior interactions with this domain to assess potential exposure.