zh-app-whastapp[.]com[.]cn

This domain is assessed at high risk due to confirmed generic phishing activity. The specific threat is credential harvesting targeting WhatsApp Web users, where victims are lured to a fraudulent login page designed to capture account credentials and potentially enable account takeover or further social engineering attacks.

Infrastructure analysis reveals the domain was created on July 01, 2026, and is registered through 万商云集（成都）科技股份有限公司. It resolves to IP address 154.195.71.88 and uses a Let's Encrypt SSL certificate to appear legitimate. VirusTotal flags this domain with 14 out of 95 security vendors marking it as malicious. AlienVault OTX indicates the domain appears in 1 threat intelligence pulse, and it remains active with no blocklist presence reported. The page title displays 'WhatsApp Web - 即时通讯平台', confirming the impersonation of the legitimate WhatsApp Web service.

Mitigation steps include blocking the domain at the network or DNS level, adding the IP address 154.195.71.88 to threat blocklists, and alerting users to avoid visiting the site or entering credentials. Organizations should monitor for compromised accounts if users have interacted with the domain, and enforce multi-factor authentication on all messaging platforms. Security teams should also review email logs for phishing campaigns referencing this domain.