zh-app-web-whatsapp[.]com[.]cn

This domain is flagged as an elevated-risk brand impersonation threat targeting WhatsApp, a widely used messaging platform. Analysis indicates the site was designed to mimic the official WhatsApp Web interface, likely to harvest user credentials or distribute malicious payloads under the guise of legitimate communication services. The page title, 'WhatsApp Web - 安全可靠的即时通讯平台,' reinforces the deception by falsely claiming security and reliability, a common tactic in phishing operations to lower user vigilance. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain resolves to IP address 156.252.40.98, hosted in Hong Kong under AS9294 (GNET INC.). It was registered on November 25, 2025, through Sichuan Yuqu Network Technology Co., Ltd., a registrar frequently associated with suspicious domains. VirusTotal reports 22 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is currently blocked by PhishDestroy. The domain lacks an SSL certificate, further reducing its legitimacy and increasing exposure to interception or tampering. Despite being taken offline, historical records confirm its active use in phishing campaigns. Mitigation steps for this brand impersonation threat include immediate blacklisting of the domain and its associated IP across enterprise and consumer security tools. Organizations should monitor for credential submission attempts or unauthorized access originating from users who may have interacted with the site. End-users should be educated on verifying domain authenticity, particularly for services like WhatsApp Web, which should only be accessed via the official whatsapp.com domain or verified application stores. Security teams are advised to review logs for connections to 156.252.40.98 and correlate with any anomalous authentication events. Given the domain's recent creation and lack of legitimate infrastructure, it is recommended to treat all interactions with this domain as potential compromise indicators.