br-whatsapp[.]cc

The domain br-whatsapp.cc was identified as a brand impersonation phishing site targeting WhatsApp users. Analysis confirms the domain was designed to mimic official WhatsApp security verification pages, as evidenced by the page title "whatsApp安全检测中心" (WhatsApp Security Detection Center). The domain is currently offline, though prior activity suggests it was operational for a limited period. Infrastructure analysis reveals the domain was flagged by 20 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered on November 10, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolved to the IP address 134.122.187.186, hosted under AS152194 (CTG Server Limited) in Hong Kong. It appeared on one security blocklist (PhishDestroy) and utilized an SSL certificate issued by R12, a low-assurance certificate authority often exploited in phishing campaigns. Current status indicates the domain has been taken offline, though residual risk may persist if users were previously exposed. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this domain, particularly if credentials were entered. Network defenders should block the domain and associated IP (134.122.187.186) at perimeter controls. Users should verify the legitimacy of any WhatsApp-related security prompts by accessing official channels directly, avoiding third-party links or unsolicited messages.