vx-zb-whatsapp[.]com[.]cn

This domain, vx-zb-whatsapp.com.cn, operates as a fraudulent WhatsApp login portal targeting Chinese-speaking users. The site displays a localized page title, "WhatsApp | 安全可靠的免费私密消息和通话," falsely presenting itself as the official WhatsApp service for secure messaging and calls. Analysis indicates the domain is designed to harvest user credentials, payment details, or distribute malware under the guise of a trusted communication platform. The Chinese-language interface suggests a targeted campaign aimed at users in regions where WhatsApp is widely used but may be subject to restrictions, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on February 25, 2026, through 成都垦派科技有限公司, a registrar frequently associated with high-risk domains. It resolves to the IP address 43.226.17.32, hosted on AS64050 (BGP Network Limited) in South Korea, an autonomous system known for hosting phishing and command-and-control infrastructure. The domain appears on one security blocklist and is flagged by 23 out of 95 security vendors on VirusTotal, with detections including phishing, fraudulent site, and credential theft classifications. The SSL certificate, issued by Let's Encrypt (R12), provides HTTPS encryption, which attackers commonly use to lend false legitimacy to malicious sites. Users who accessed vx-zb-whatsapp.com.cn should assume credential compromise and take immediate remediation steps. Disconnect the device from the network and perform a full antivirus scan using updated detection signatures. Reset passwords for WhatsApp and any accounts sharing the same credentials, enabling multi-factor authentication where available. Monitor financial statements and account activity for unauthorized transactions, as phishing sites often collect payment details. Report the incident to local cybersecurity authorities and consider notifying contacts who may have received suspicious messages originating from the compromised account. Organizations should add the domain and associated IP (43.226.17.32) to network blocklists to prevent further access.