yfc-wswhatsapp[.]cc

This domain, yfc-wswhatsapp.cc, is identified as a brand impersonation threat targeting Gmail users. The site masquerades as a legitimate web client, likely designed to harvest login credentials or distribute malicious payloads under the guise of a trusted service. The page title, 'web.whatsapp| 如何保护聊天隐私：设置安全选项,' suggests an attempt to deceive users by combining WhatsApp branding with Gmail impersonation, potentially exploiting confusion between messaging and email platforms. Technical indicators confirm elevated risk. The domain is flagged by 18 out of 95 security vendors on VirusTotal, with registration handled through Dominet (HK) Limited. It resolves to the IP address 103.99.210.152, hosted under AS205960 HDTIDC LIMITED in South Korea. The domain was created on October 02, 2025, and currently lacks an SSL certificate, a common red flag for phishing infrastructure. It appears on one security blocklist and is blocked by at least one threat intelligence feed, though it is not currently listed on Google Safe Browsing. As of the latest assessment, yfc-wswhatsapp.cc has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat due to its recent creation and known association with malicious activity. Organizations should monitor for re-emergence under similar domains or IPs, particularly those registered through the same provider. Users are advised to verify domain authenticity before entering credentials and to report any suspicious login pages to their security teams. Persistent monitoring of related indicators of compromise (IOCs) is recommended to mitigate residual risk.