cctv-whatsapp[.]com[.]cn

This domain is flagged as an active WhatsApp account hijacking phishing infrastructure targeting users through a fraudulent 'Security Check' interface. Analysis indicates the site is designed to harvest login credentials by mimicking legitimate authentication processes, potentially enabling unauthorized access to private messaging accounts and associated personal data. The page title 'Security Check' suggests an attempt to exploit user trust in verification procedures, a common tactic in credential theft campaigns. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain cctv-whatsapp.com.cn was registered on April 21, 2026 through 成都垦派科技有限公司, with an anomalous future creation date that may indicate domain age manipulation. It resolves to IP address 104.21.9.182 hosted by Cloudflare, Inc. in Canada, while using a Let's Encrypt SSL certificate (serial number prefix E8) to appear legitimate. Security vendor detection rates show 23 out of 95 engines on VirusTotal flagging the domain as malicious, and it appears on one security blocklist, including PhishDestroy's phishing domain registry. Users who visited cctv-whatsapp.com.cn should immediately revoke any entered credentials through WhatsApp's account recovery options and enable multi-factor authentication. All devices used to access the site should undergo malware scanning, as credential phishing pages often deploy secondary payloads. Security teams should block the domain and IP address 104.21.9.182 at network perimeter controls, and monitor for any unauthorized access attempts using credentials potentially compromised through this infrastructure. The anomalous 2026 registration date suggests possible domain spoofing techniques that may reappear under different names.