app-cn-web-whatsapp[.]com[.]cn

This domain, app-cn-web-whatsapp.com.cn, was designed to mimic the official WhatsApp Web service to deceive users into entering their login credentials. The site presents a Chinese-language interface titled 'WhatsApp网页版 - 在电脑上畅享即时通讯,' closely resembling the legitimate WhatsApp Web portal. Attackers use such pages to harvest usernames, passwords, and session tokens, enabling unauthorized access to personal accounts, message interception, and potential identity theft. The fraudulent nature of this site is further evidenced by its infrastructure and detection patterns. Analysis indicates this domain is flagged by 17 out of 95 security engines on VirusTotal, a clear indicator of malicious intent. The domain was registered on February 25, 2026, through 成都垦派科技有限公司, a registrar based in Chengdu, China. Notably, the creation date is in the future, which is a common tactic to evade initial scrutiny and extend the domain's operational lifespan before detection. The site resolved to IP address 168.76.142.193, hosted under AS137951 (ASLINE LIMITED) in Hong Kong, a region frequently associated with phishing and fraudulent hosting providers. The SSL certificate, issued by Let's Encrypt, provides encryption but does not validate the site's legitimacy, a tactic often exploited by threat actors. If you accessed this domain or entered any credentials, immediate action is required. First, disconnect the device from the network to prevent further data transmission. Change the passwords for WhatsApp and any other accounts using the same credentials, prioritizing accounts with sensitive or financial information. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unrecognized logins or messages sent from your account. Consider running a full antivirus scan on the device to detect any malware that may have been installed during the interaction. Finally, report the incident to your organization's security team or a trusted cybersecurity professional for further guidance.