cn[.]whats-whatsap[.]com[.]cn

The domain cn.whats-whatsap.com.cn was registered on July 20, 2026 through 北京新网数码信息技术有限公司 and is currently active. Authority for the zone is delegated to ns5.west.cn and ns6.west.cn, and DNS resolution points to the single IPv4 address 168.222.65.238. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that threat‑intel feeds have already flagged it as malicious. VirusTotal analysis shows that 13 of 95 scanned security vendors label the domain as malicious, providing moderate‑to‑high confidence that the infrastructure is being used for phishing. No additional public indicators such as SSL certificate details, HTTP response codes, or page titles have been disclosed, so the exact content served by the site remains unverified. The lack of further telemetry means that the specific phishing campaign (e.g., targeted brand or credential‑capture technique) cannot be confirmed at this time. Defenders should add the domain to local blocklists, enforce DNS‑level denial for the IP address 168.222.65.238, and monitor traffic to the associated nameservers ns5.west.cn and ns6.west.cn for any anomalous connections. Continuous re‑scanning on platforms such as VirusTotal is advised to capture any changes in vendor detection ratios. Organizations using outbound filtering should ensure that any email or web traffic directed to this domain is dropped, and incident response teams should treat any credential submissions to the domain as compromised. Given the recent creation date and the existing blocklist entry, the domain is likely part of an emerging phishing infrastructure and should be treated as high‑risk until further analysis clarifies its payload and target profile.