app-lxj-whatshktw[.]com

The domain app-lxj-whatshktw.com has been identified as a phishing infrastructure specifically designed for brand impersonation targeting Gmail users. Analysis of the domain reveals it was actively used to mimic Gmail login portals, though the page title—"whatsapp網頁登錄入口- 使用表情符號的技巧：增添聊天的趣味性"—suggests an attempt to deceive users by leveraging WhatsApp-themed content as a lure. The domain is currently offline, but prior activity indicates a deliberate effort to harvest credentials under false pretenses. Technical indicators confirm the domain's malicious nature. It was flagged by 17 of 95 security vendors on VirusTotal, a clear outlier for benign domains. Registered on October 8, 2025, through Dominet (HK) Limited, the domain resolved to the IP address 103.254.73.177, hosted under AS205960 (HDTIDC LIMITED) in South Korea. No SSL certificate was detected, further reducing trust signals. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, reinforcing its classification as phishing infrastructure. Infrastructure analysis reveals the use of a Hong Kong-based registrar and a hosting provider with a history of abuse, aligning with patterns observed in credential harvesting campaigns. As of the latest verification, app-lxj-whatshktw.com has been taken offline, though residual risk remains due to the potential for reactivation or migration to a new domain. Organizations and users are advised to block the domain and its associated IP (103.254.73.177) at the network level. Security teams should monitor for similar domains registered through Dominet (HK) Limited or resolving to the same autonomous system (AS205960). End users should be educated on recognizing brand impersonation tactics, particularly those involving mismatched page titles and login prompts. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended to mitigate account compromise risks.