contact-on-whatsapp[.]com[.]cn

This domain, contact-on-whatsapp.com.cn, is actively engaged in credential phishing targeting WhatsApp users. Analysis indicates the infrastructure is designed to mimic legitimate WhatsApp communication channels, likely harvesting login credentials or personal data under false pretenses. The domain remains operational as of the latest verification, posing a direct threat to users encountering fraudulent links or messages. Infrastructure analysis reveals the domain resolves to the IP address 43.226.17.69, hosted by a provider in Hong Kong. It is flagged by 22 of 95 security vendors on VirusTotal, indicating widespread detection of its malicious intent. The domain was registered on May 22, 2026, an unusual future date suggesting potential obfuscation or misconfiguration. It appears on one security blocklist and uses an SSL certificate issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 hierarchy. The page currently returns a 404 Not Found error, which may indicate temporary takedown of the phishing landing page or evasion tactics. Current status confirms the domain remains active and unresolved, maintaining its potential for harm. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for related indicators, including SSL certificate fingerprints and registrar details, to preempt further abuse. End users should be educated on recognizing phishing attempts, particularly those impersonating WhatsApp, and encouraged to verify URLs before entering credentials. Immediate reporting to relevant security platforms is recommended to mitigate ongoing risks.