web[.]whatssaapp[.]com[.]cn

The domain web.whatssaapp.com.cn was registered on 2025-10-18 through 四川域趣网络科技有限公司 and delegated to the authoritative name servers ns1.365.hk and ns2.365.hk. DNS resolution points to the IPv4 address 154.55.236.51, which belongs to AS174 operated by Cogent Communications and is geolocated in the United States. No TLS certificate is presented, indicating the site is served over plain HTTP only. The HTTP response, when captured before the takedown, returned a page title of “WhatsApp Web”, directly matching the brand target “whatsapp”.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. Independent scanning on VirusTotal recorded 15 detections out of 95 submitted security engines, confirming malicious classification across multiple vendors. The site was subsequently flagged and taken offline by the PhishDestroy blocking service. Current status is offline, but the infrastructure components—including the registrar, name servers, and hosting IP—remain active and could be reused for future impersonation campaigns.

Defenders should add the domain and its resolving IP to network deny lists, monitor the associated ASN for any new malicious resolutions, and enforce strict TLS‑only policies to prevent accidental connections to non‑encrypted endpoints. Continuous observation of the registrar’s future registrations is advised, as the same registrar has been used for other impersonation attempts in the past. Because the site lacked an SSL certificate and no further page content was captured, the exact phishing payload cannot be verified, representing a gap that analysts should aim to fill if the domain resurfaces.