web-wap-whatsappweb[.]com[.]cn

Analysis of the domain web-wap-whatsappweb.com.cn indicates a confirmed brand impersonation campaign targeting WhatsApp users. The site was registered on October 18, 2025 by 四川域趣网络科技有限公司 and is hosted on IP 154.55.246.54, which belongs to AS174 Cogent Communications, LLC in the United States. No TLS certificate is present, and the HTTP service is currently offline, consistent with the reported status of the domain being taken offline. The page title returned by the server, "WhatsApp网页版," directly references the WhatsApp web client, reinforcing the impersonation intent.

Threat intelligence aggregators have recorded the domain in multiple sources: AlienVault OTX references it in sixteen separate pulses, and VirusTotal reports that seventeen of ninety‑five scanning engines flagged the domain as malicious. Gridinsoft assigns a trust score of zero out of one hundred, and the domain appears on a single security blocklist. The authoritative nameservers ns1.365.hk and ns2.365.hk resolve to the same hosting provider, matching the observed IP infrastructure. PhishDestroy has explicitly blocked the domain, categorizing it under the "Social Media Phishing" scam type.

While the exact page content has not been publicly examined, the combination of the brand‑specific title, the low trust score, multiple vendor detections, and blocklist inclusion provides strong evidence of a malicious impersonation operation. Defenders should add the domain and its associated IP address to perimeter denial lists, monitor for any resurgence of the host under new subdomains, and consider extending detection rules to capture similar naming patterns that combine "web", "wap", and the target brand. Continuous observation of the registrar and nameserver activity is recommended to detect potential re‑registration attempts.