app-xvf-whatshktw[.]com

This domain, app-xvf-whatshktw.com, is flagged as a brand impersonation threat designed to deceive users by mimicking official Facebook and WhatsApp properties. The page title, 'WhatsApp 官網- 琯理聯系人列表的技巧：快速添加與刪除,' suggests an attempt to lure Chinese-speaking users into engaging with fraudulent content under the guise of legitimate WhatsApp functionality. Analysis indicates no direct evidence of a drainer kit, though the infrastructure aligns with typical phishing campaigns targeting social media credentials or personal data. The domain does not appear to host malware but focuses on social engineering to harvest user information or propagate further fraudulent activity.

Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on October 08, 2025, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 103.254.73.165, hosted in South Korea under AS205960 (HDTIDC LIMITED), an autonomous system with a history of hosting malicious infrastructure. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists. Google Safe Browsing does not currently list the domain, though this may reflect its recent takedown rather than a clean status.

As of the latest assessment, app-xvf-whatshktw.com has been taken offline, likely due to enforcement actions by security providers such as PhishDestroy and PhishingDB. While the immediate threat is mitigated, residual risk remains due to the domain's recent registration and the potential for re-activation under a different IP or registrar. Organizations and users are advised to monitor for similar domains using the seed '0aace9' or variations of the impersonated brands. Network administrators should block the IP 103.254.73.165 and any associated domains registered through Dominet (HK) Limited. End-users should verify the authenticity of any WhatsApp or Facebook-related communications by cross-referencing official domains and enabling multi-factor authentication to mitigate credential theft risks.