whurtsn[.]cn

This domain, whurtsn.cn, is flagged for brand impersonation targeting WhatsApp, a widely used messaging platform. The site mimics legitimate WhatsApp login or account management pages, potentially tricking users into entering credentials or personal information. Such impersonation attempts are often used to harvest login details, distribute malware, or facilitate unauthorized account access. The lack of an SSL certificate further increases the risk, as any data transmitted would be unencrypted and vulnerable to interception. Analysis indicates the domain was registered on December 24, 2025, through 邦宁数字技术股份有限公司, a registrar associated with other suspicious domains. It resolves to the IP address 103.119.15.138, hosted under AS140869 (Turing Group Limited) in the United States. At the time of detection, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The page title explicitly displays 'WhatsApp,' reinforcing its impersonation intent. If you visited whurtsn.cn or entered any information on the site, immediate action is required. First, change the passwords for your WhatsApp account and any other services where the same credentials may have been reused. Enable two-factor authentication (2FA) if not already active. Monitor your accounts for unusual activity, such as unauthorized logins or messages sent from your account. If you downloaded any files or clicked links from the site, run a full scan using updated antivirus software to detect potential malware. Report the incident to your organization’s security team or a trusted cybersecurity professional for further guidance.