pc[.]whatseye[.]cc

pc.whatseye.cc is an active brand‑impersonation infrastructure observed targeting WhatsApp users. The domain was registered on 11 October 2025 through Dominet (HK) Limited and uses the public nameservers ns1.domainnamedns.com and ns2.domainnamedns.com. DNS resolution points to the IP address 103.99.210.57, which belongs to AS205960 operated by HDTIDC LIMITED and is geolocated in South Korea. No TLS certificate is presented for the host, indicating that any web service would be delivered over plain HTTP.

The site title retrieved from the server reads “WhatsApp官方網站- 夜間模式設置：保護眡力的實用功能”, confirming the intent to mimic a WhatsApp login or settings page. Gridinsoft assigns a trust score of 0 / 100, and fourteen of ninety‑five VirusTotal scanners have flagged the domain as malicious. The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy feed. The overall risk has been classified as elevated and the current operational status is offline, suggesting that the content has been removed or the hosting has been taken down.

Analysis indicates that the infrastructure was deliberately crafted to harvest credentials or otherwise deceive WhatsApp users, leveraging a Chinese‑language page title to increase plausibility for targeted victims. Defenders should continue to block the domain and the associated IP address at perimeter controls, update URL filtering policies, and monitor the AS205960 range for similar patterns. Because the domain lacks an SSL certificate and the page content has not been publicly archived, further forensic capture of the original landing page would be required to confirm the exact phishing vector. Until such artefacts are obtained, the existing indicators—registration details, DNS configuration, IP ownership, trust scores, and vendor detections—provide sufficient evidence for inclusion in threat‑intel feeds and for proactive remediation in enterprise environments.