whats-hk-whatsapp[.]com[.]cn

Domain whats-hk-whatsapp.com.cn is classified as a generic_phishing infrastructure component currently marked offline. Analysis indicates impersonation of WhatsApp branding cues through deceptive naming convention, a common tactic in credential harvesting campaigns targeting messaging platforms. The domain likely formed part of a short-lived phishing lifecycle, consistent with rapid deployment and takedown patterns observed in similar infrastructure.

Telemetry shows the domain flagged by 21 of 95 VirusTotal vendors and listed on 1 security blocklist. It resolves to IP 43.226.17.55 associated with Hong Kong WAN Shou Network Technology Limited infrastructure. Domain registration date is May 22, 2026. SSL certificate status is unknown, limiting transport-layer trust verification.

Current status indicates the domain is offline with HTTP response returning 404 Not Found, suggesting takedown or sinkholing after detection. Despite inactivity, historical resolution and detection signals indicate elevated residual risk if the domain becomes active again. Security guidance recommends enforcing network-level blocks, adding the domain and related substrings to threat intelligence filters, and monitoring DNS queries for variants of the WhatsApp branding pattern. Any communication referencing this domain should be treated as phishing and users should be instructed not to submit credentials or verification codes. Continuous monitoring is advised for re-registration under alternate TLDs or similar lexical structures, as adversaries frequently rotate domains after exposure.