h5[.]msg-whatapp[.]com[.]cn

Analysis of h5.msg-whatapp.com.cn shows the domain is actively used for malicious purposes. The domain was registered on July 28, 2026 through the registrar 万商云集（成都）科技股份有限公司 and resolves to the IPv4 address 192.197.113.111. Hosting details indicate the authoritative name servers are ns1.kenpains.com and ns2.kenpains.com, which are not associated with reputable cloud providers. VirusTotal scans have recorded 12 detections out of 91 security vendors, suggesting that a minority of scanners have identified malicious patterns, but the majority have not flagged the domain.

The domain appears on at least one public blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its classification as a high‑risk phishing resource. No public SSL certificate information, HTTP response codes, or page title data are currently available, limiting the ability to assess the surface‑level behavior of the site. The lack of visible page metadata means that defenders cannot confirm whether the site mimics a legitimate brand or employs credential‑harvesting forms, although its naming pattern strongly implies an attempt to impersonate WhatsApp services. Given the recent registration date, the active blocklist presence, and the partial detection by multiple vendors, the domain should be treated as hostile.

Defensive recommendations include adding the domain and its resolving IP address to outbound and inbound firewall deny lists, updating DNS filtering policies to block the nameservers ns1.kenpains.com and ns2.kenpains.com, and ensuring that endpoint protection solutions ingest the 12 VirusTotal detections. Continuous monitoring of the IP 192.197.113.111 for any changes in reputation or additional malicious activity is advised, as the infrastructure may be repurposed for further campaigns. Until more detailed payload or page content analysis becomes available, the prudent stance is to assume the domain is being used for credential‑stealing or related phishing operations.