wap[.]message-whatapp[.]com[.]cn

Analysis confirms that wap.message-whatapp.com.cn remains active as of August 06, 2026 and is classified as a generic phishing vector. The domain was registered on July 28, 2026 through 万商云集（成都）科技股份有限公司 and is served by the authoritative nameservers ns1.kenpains.com and ns2.kenpains.com. DNS resolution points to the IPv4 address 192.197.113.111. VirusTotal records indicate that 12 of 91 security vendors have flagged the domain, providing independent corroboration of malicious intent.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its reputation as a threat. No public evidence is available regarding SSL certificate details, HTTP response codes, page title, or content analysis, leaving those aspects unverified. Likewise, additional context such as ASN, geographic location of the hosting IP, or associated malware kits has not been disclosed.

Defenders should treat the domain as high‑risk: incorporate the domain and its resolving IP into outbound filtering rules, update intrusion detection signatures, and ensure that any internal email gateways deny messages containing links to this host. Continuous monitoring of the IP 192.197.113.111 for anomalous traffic patterns is advised, as well as periodic re‑scans on VirusTotal or similar platforms to capture any changes in vendor detection rates. Given the active blocklist status and multiple vendor detections, proactive blocking is the recommended mitigation while awaiting further forensic details.