pc[.]whatsgkw[.]cc

This domain, pc.whatsgkw.cc, was identified as a brand-impersonation phishing site targeting WhatsApp users, specifically presenting itself as a computer login portal for the messaging service. Analysis indicates the domain was created on October 11, 2025, and registered through Dominet (HK) Limited. It resolved to IP address 103.254.73.171, hosted on AS205960 (HDTIDC LIMITED) in South Korea. The page title, 'whatsapp電腦耑登錄 - - 登錄問題的解決方案：輕松排除故障,' suggests the site was designed to mimic WhatsApp's desktop login troubleshooting page, likely to harvest credentials or distribute malware.

The domain was flagged by 14 of 95 security vendors on VirusTotal and appeared on at least one security blocklist, including PhishDestroy. No SSL certificate was present, which is atypical for legitimate login portals and increases the likelihood of interception of unencrypted data. Nameservers were ns1.domainnamedns.com and ns2.domainnamedns.com, a configuration often associated with low-cost or disposable hosting setups. As of July 23, 2026, the domain has been taken offline, though defenders should monitor for re-registration or migration to new infrastructure.

Defenders are advised to block the domain and its resolving IP at the network level. Given the lack of SSL and the use of a known bulletproof hosting provider, any future domains resolving to 103.254.73.171 or associated nameservers should be treated with elevated scrutiny. While the exact phishing kit or payload is not confirmed, the page title indicates a focus on WhatsApp users, so organizations should alert employees or customers to potential credential-harvesting attempts linked to this campaign. Retrospective log analysis for connections to this domain or IP is recommended to identify any prior compromise.