whcio[.]org

This domain, whcio.org, is identified as a credential theft operation designed to harvest usernames, passwords, and other sensitive authentication data. Analysis indicates the site mimics legitimate login portals, tricking users into submitting credentials under false pretenses. The page title '网站筹建中' (translated as 'Website Under Construction') may serve as a placeholder or decoy to obscure its malicious intent while awaiting deployment of phishing kits or redirect scripts. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on March 15, 2022, through Gname.com Pte. Ltd., and is currently offline. It appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal. The domain resolves to the IP address 154.219.125.3, hosted on AS8796 (FASTNET DATA INC) in the United States. The SSL certificate is issued by Let's Encrypt (R13), a common choice for malicious actors due to its accessibility and short-lived validity. Users who visited whcio.org should assume their credentials may have been compromised. Immediately reset passwords for any accounts accessed or submitted on the site, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication where available. Monitor accounts for unauthorized activity, including logins from unfamiliar locations or devices. If financial data was entered, contact relevant institutions to flag potential fraud. Clear browser cache and cookies to remove any lingering session tokens, and consider scanning the device for malware using updated security tools.