glory[.]ring-whatapp[.]com[.]cn

On 2026-08-04 the domain glory.ring-whatapp.com.cn was observed as active infrastructure supporting a generic phishing campaign. VirusTotal scans returned 14 positive detections out of 91 participating security vendors, indicating that multiple AV engines have identified malicious behavior associated with the host. The domain is listed on a single public security blocklist and is actively blocked by the PhishDestroy mitigation service, demonstrating that at least one external sinkhole has recognized it as hostile.

No additional public data such as registrar information, ASN, hosting IP, SSL certificate details, or HTTP response codes were supplied, limiting the depth of the current technical profile. The absence of further telemetry means that the exact payload delivery method, target brand, or credential‑stealing kit cannot be confirmed at this time. Analysts should treat the domain as a confirmed phishing vector given the vendor detections and blocklist presence, and should incorporate it into network‑level deny lists, DNS sinkhole configurations, and endpoint protection rule sets.

Continuous monitoring of VirusTotal, passive DNS, and reputation feeds is advised to capture any changes in detection rate or the emergence of new infrastructure tied to the same seed. Defensive teams are encouraged to quarantine any internal traffic to the domain and to educate users about unsolicited communications that reference the “ring‑whatapp” naming pattern, as this appears to be the lure employed by the campaign.