whatsmog[.]cc

This domain, whatsmog.cc, was observed delivering a brand‑impersonation campaign targeting WhatsApp users. The site was registered through Dominet (HK) Limited and the registration record shows a creation date of 11 October 2025. DNS resolution points to the IPv4 address 103.254.73.202, which belongs to ASN AS205960 operated by HDTIDC LIMITED in South Korea. The hosting infrastructure is exposed through four generic nameservers (ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, ns4.domainname). No TLS certificate is presented, indicating that the service is delivered over plain HTTP.

The page title returned by the server is “whatsapp网页版入口 - | 绘图与表情功能：增加聊天趣味”, confirming the use of the WhatsApp brand in the content. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. The domain is currently listed on one security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis shows that 15 of 95 scanning engines flagged the domain as malicious, and AlienVault OTX contains the indicator in 17 separate threat‑intel pulses. The site has been taken offline, and no SSL certificate is available, which further limits immediate interaction but does not negate the prior malicious activity.

Analysts should continue to monitor the IP address 103.254.73.202 for related activity, enforce blocklist entries across perimeter defenses, and consider adding the domain to internal watchlists. Because the page content has not been publicly examined, the exact phishing vector remains unknown. Defensive teams are advised to update URL filtering rules, inspect DNS queries for the four associated nameservers, and verify that any outbound connections to the identified IP are denied. Ongoing correlation with the 17 OTX pulses may reveal additional infrastructure or campaign variants.