suck-whatsapp[.]com[.]cn

This domain, suck-whatsapp.com.cn, is flagged for hosting a WhatsApp credential harvesting phishing scheme. Analysis indicates the site is designed to mimic legitimate WhatsApp login pages, tricking users into entering their account credentials, which are then captured by threat actors. The fraudulent nature of the site is further suggested by its deceptive page title, 'Global Apparel Group | Premium Garment & Textile Wholesale,' which does not align with the expected branding or content of a messaging service. Infrastructure analysis reveals several red flags supporting the phishing classification. The domain was registered on June 23, 2026, through Dynadot Inc, a registrar frequently abused by malicious actors for its accessibility and privacy features. As of the latest scan, the domain resolves to the IP address 104.21.87.88, a Cloudflare-associated address often used to obfuscate the true hosting origin. Notably, the domain has not yet been flagged by any of the 95 security engines on VirusTotal, highlighting the evolving and evasive nature of this threat. Users who have visited suck-whatsapp.com.cn or entered credentials on the site should take immediate action to mitigate risks. First, change the passwords for any accounts accessed on the site, prioritizing WhatsApp and any linked email addresses. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or messages sent without consent. If financial or personally identifiable information was entered, consider placing a fraud alert on credit files and reviewing bank statements for unauthorized transactions. Finally, report the domain to relevant authorities or security organizations to aid in takedown efforts and prevent further victimization.