app-xpr-whatshktw[.]com

The domain app-xpr-whatshktw.com represents a brand impersonation threat specifically targeting Gmail users. This malicious domain attempts to deceive visitors into believing they are accessing a legitimate Gmail service, thereby aiming to harvest login credentials. The page title discovered, 'whatsapp網頁版登錄- 使用表情符號的技巧：增添聊天的趣味性', suggests a dual tactic of impersonating both Gmail and WhatsApp Web login interfaces to maximize victim exposure.

Technical indicators for this domain are alarming. VirusTotal analysis shows that 13 out of 95 security vendors flag this domain as malicious, indicating strong consensus on its threat nature. The domain resolves to IP address 103.254.73.209 and was registered on October 8, 2025, through Dominet (HK) Limited. It appears on two security blocklists and is also present in 16 AlienVault OTX threat intelligence pulses. Google Safe Browsing has not added it to its blocklist, but the domain's current status is offline, suggesting it may have been taken down after detection.

PhishDestroy identifies that the domain is now offline, likely due to reporting and takedown actions by security researchers or hosting providers. However, users remain at risk if they visited the site prior to its removal or if similar domains emerge. The absence of an SSL certificate further signals its fraudulent nature. Users who may have entered credentials should change their passwords immediately and enable two-factor authentication on their Gmail accounts. Monitoring for suspicious activity on accounts is also recommended. PhishDestroy continues to track this domain's indicators for future threat detection.