app-ap-whatsappweb[.]com[.]cn

The domain app-ap-whatsappweb.com.cn is identified as a high-risk brand impersonation threat, specifically targeting Microsoft users through a fraudulent WhatsApp Web interface. Analysis confirms this domain is designed to deceive visitors into believing they are accessing a legitimate WhatsApp service, while its infrastructure and content are engineered for credential harvesting or malware distribution. Currently, the domain is offline, but prior activity and technical indicators warrant continued monitoring and caution. Infrastructure analysis reveals critical red flags: the domain was flagged by 19 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. Registered through 四川域趣网络科技有限公司 on October 19, 2025, the domain resolves to the IP address 154.55.240.42, hosted under AS174 (Cogent Communications, LLC) in the United States. Notably, the domain lacks an SSL certificate, a common characteristic of phishing sites aiming to avoid encryption-related scrutiny. The page title, WhatsApp网页版, further reinforces the impersonation of WhatsApp’s web platform, despite the domain’s primary targeting of Microsoft users. The current status of app-ap-whatsappweb.com.cn is offline, though historical data and threat indicators suggest it may resurface under altered infrastructure or similar domains. Organizations and users are advised to block the domain and its associated IP (154.55.240.42) at the network level to prevent accidental exposure. Security teams should monitor for newly registered domains under the same registrar or IP range, as threat actors frequently reuse infrastructure. End users should verify domain authenticity before entering credentials, particularly when redirected from unsolicited links. If interaction with this domain occurred, immediate password resets and system scans are recommended to mitigate potential compromise.