app-top-whatsapp[.]com[.]cn

This domain, app-top-whatsapp.com.cn, presents itself as a legitimate WhatsApp Web portal under the title 'WhatsApp网页版 - Web网页聊天平台 - 多端聊天.' Analysis indicates it is a credential harvesting site designed to mimic the official WhatsApp Web interface. Visitors are prompted to enter their login credentials, which are then captured by threat actors for unauthorized account access, message interception, or further phishing attacks. The site targets users seeking multi-device chat functionality, exploiting trust in the WhatsApp brand. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 23, 2026, through Dynadot Inc, an unusually future-dated creation that suggests domain spoofing or registry manipulation. It resolves to the IP address 101.32.45.189, located in Hong Kong and associated with Aceville Pte.ltd, a provider frequently linked to phishing infrastructure. Security vendors have flagged the domain in 22 out of 95 scans on VirusTotal, and it appears on at least one security blocklist. The SSL certificate, issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 chain, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Users who have visited app-top-whatsapp.com.cn or entered credentials should take immediate action. First, revoke access to any linked devices or sessions through the official WhatsApp settings. Change the account password using a trusted device and enable two-step verification to add an extra security layer. Monitor the account for unauthorized logins or suspicious messages sent from it. If financial or sensitive personal data was entered, consider reporting the incident to relevant authorities and monitoring for signs of identity theft. Avoid reusing passwords across services, and verify the authenticity of any communication claiming to be from WhatsApp by cross-checking with official sources.