eov-wswhatsapp[.]cc

This domain, eov-wswhatsapp.cc, operates as a brand impersonation platform designed to steal Facebook login credentials. The site mimics legitimate Facebook services, presenting users with a fake WhatsApp Web login interface that includes privacy-related content in Chinese. Victims who enter their credentials on this page unknowingly surrender their account access to threat actors, enabling subsequent account takeovers, social engineering attacks, or unauthorized access to connected services. Analysis indicates the domain was created on October 02, 2025, through the registrar Dominet (HK) Limited, and resolves to the IP address 103.99.210.155 located in South Korea under AS205960 HDTIDC LIMITED. Security vendors have flagged this domain with a detection ratio of 17 out of 95 on VirusTotal, and it appears on two security blocklists, including PhishDestroy and PhishingDB. Notably, the domain lacks an SSL certificate, which is unusual for legitimate services and serves as a red flag for potential victims. Users who visited eov-wswhatsapp.cc should immediately change their Facebook passwords and enable multi-factor authentication if they entered any credentials. It is also recommended to review recent login activity for unfamiliar sessions and revoke access to any suspicious third-party applications connected to the account. Devices used to access the site should undergo a malware scan to ensure no additional payloads were delivered. Given the domain's creation date and infrastructure, users should remain vigilant for similar impersonation attempts targeting social media platforms.