zh-app-web-whatsapp[.]hl[.]cn

This domain, zh-app-web-whatsapp.hl.cn, poses a direct threat as a fraudulent WhatsApp Web login portal designed to harvest user credentials. The page mimics the legitimate WhatsApp Web interface, displaying the title 'WhatsApp Web - 安全可靠的即时通讯' to deceive users into entering their account details. Such phishing schemes often lead to unauthorized access, account takeovers, and subsequent exploitation for further malicious activities, including spam distribution or financial fraud. The use of a trusted brand name increases the likelihood of successful deception, particularly among users unfamiliar with domain verification practices.

Analysis of the domain's infrastructure reveals multiple high-risk indicators. The domain is registered through 成都垦派科技有限公司 and was created on February 25, 2026, suggesting a short-lived or disposable registration typical of phishing campaigns. It resolves to the IP address 168.76.143.194, hosted under AS137951 (ASLINE LIMITED) in Hong Kong, a region frequently associated with malicious hosting. VirusTotal detection rates show 25 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist, specifically PhishDestroy. The SSL certificate issued by Let's Encrypt (R12) provides a false sense of security, as phishing domains commonly use valid certificates to evade browser warnings.

Users who have visited zh-app-web-whatsapp.hl.cn or entered credentials on the site should take immediate action to mitigate risks. First, change the password for the affected WhatsApp account and enable two-factor authentication if not already active. Review the account for any unauthorized sessions or linked devices and terminate them. Monitor associated email accounts and other linked services for signs of compromise, such as password reset emails or unusual login attempts. If financial or sensitive personal information was entered, consider reporting the incident to relevant authorities and monitoring for identity theft or fraudulent transactions. Finally, ensure that security software is updated and conduct a full system scan to detect any potential malware infections resulting from the interaction.