cdn-a-whatsapp[.]com[.]cn

Analysis of cdn-a-whatsapp.com.cn indicates a high-risk phishing domain targeting WhatsApp credentials, currently active as of July 12, 2026. The domain was registered on May 22, 2026, through 万商云集（成都）科技股份有限公司, a registrar frequently associated with suspicious infrastructure. It resolves to IP address 43.226.17.55, hosted under Hong Kong-based WAN Shou Network Technology Limited, an autonomous system with a history of supporting phishing and fraudulent domains. Nameservers ns1.kenpains.com and ns2.kenpains.com further link this domain to known malicious DNS providers. The domain is flagged by 20 security vendors on VirusTotal and appears on at least one security blocklist. It was also identified in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed detection within the threat intelligence community. Despite returning an HTTP 200 status, the page title reads '404 Not Found', which may indicate either a placeholder page, a misconfigured phishing kit, or an attempt to evade automated detection by serving benign content to crawlers while delivering malicious payloads to targeted users. No SSL certificate information is currently available, increasing the likelihood of unencrypted credential harvesting. The domain's naming convention—using 'cdn-a-whatsapp'—strongly suggests an intent to impersonate WhatsApp infrastructure, likely to deceive users into entering login credentials or downloading malicious content under the guise of a legitimate service update or security alert. Defenders should treat this domain as active and malicious. Network-level blocking of 43.226.17.55 and the associated nameservers is recommended. Organizations should monitor for connections to this IP and domain, particularly from endpoints where WhatsApp or related messaging services are used.