m[.]jzg-wswhatsapp[.]cc

The domain m.jzg-wswhatsapp.cc has been identified as a high-risk brand impersonation threat targeting WhatsApp users. Analysis confirms this infrastructure was designed to mimic WhatsApp's desktop login interface, specifically presenting a Chinese-language page titled 'whatsapp电脑端登录| 设置和管理聊天通知：确保重要消息不遗漏.' The domain is currently offline, though prior activity suggests it was operational for credential harvesting purposes. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on October 02, 2025, through Dominet (HK) Limited, a registrar frequently associated with suspicious registrations. It resolves to the IP address 103.99.210.170, hosted in South Korea under AS205960 (HDTIDC LIMITED). Security vendors flagged this domain at a rate of 18 detections out of 95 on VirusTotal, while Google Safe Browsing classified it as phishing. Two independent threat intelligence blocklists—PhishDestroy and PhishingDB—have listed this domain. Notably, the infrastructure lacks SSL certification, increasing the risk of unencrypted data interception. Current status indicates the domain has been taken offline, though similar infrastructure may reemerge under different domains. Organizations and users are advised to implement the following mitigations: block the domain and its resolving IP (103.99.210.170) at the network perimeter, monitor for related domains registered through Dominet (HK) Limited, and educate users on recognizing impersonation attempts targeting messaging platforms. Security teams should also review logs for connections to the identified IP address and domain, particularly from endpoints accessing WhatsApp or other communication tools. Proactive monitoring of newly registered domains with similar naming patterns (e.g., 'wswhatsapp,' 'whatsapp-login') is recommended to detect potential resurgence of this threat.