oiw-wahst5pp[.]com

This domain is flagged for elevated-risk brand impersonation targeting WhatsApp users through a fraudulent web login interface. Analysis indicates the threat type involves credential harvesting, leveraging the page title 'ws-web' to mimic legitimate WhatsApp Web services. The domain’s infrastructure and content are designed to deceive users into submitting sensitive account details under false pretenses. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GKG.Net, Inc., a registrar with historical associations to malicious domains. It resolves to the IP address 103.80.133.35, hosted under AS205960 (HDTIDC LIMITED) in South Korea. Detection metrics show 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two distinct security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Let’s Encrypt (R12), provides minimal assurance due to its automated issuance process, which is frequently exploited by threat actors. Mitigation against this threat involves immediate blocking of the domain and its resolving IP at the network perimeter. Organizations should update endpoint protection rules to detect and quarantine attempts to access the domain or its associated infrastructure. Users should be educated to verify the authenticity of WhatsApp Web login pages by checking for official domain names (e.g., web.whatsapp.com) and HTTPS certificate details. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate the impact of credential theft, even if login details are compromised.