svi-wswhatsapp[.]cc

This domain, svi-wswhatsapp.cc, is flagged for brand impersonation targeting Gmail users. Analysis indicates the site mimics WhatsApp Web login pages while harvesting credentials intended for Gmail accounts, a tactic commonly associated with phishing campaigns designed to exploit brand recognition. The page title, 'whatsapp在线登录电脑- 如何设置提醒功能：不再错过重要日程,' suggests a localized attack vector aimed at Chinese-speaking users, further aligning with targeted credential theft operations. No evidence of a drainer kit was observed, but the domain’s infrastructure and content structure are consistent with large-scale phishing frameworks. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 02, 2025, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 103.80.133.104, hosted under AS205960 (HDTIDC LIMITED) in South Korea, a network segment with a history of hosting phishing and malware distribution sites. VirusTotal reports 17 out of 95 security vendors detecting the domain as malicious, while it appears on two blocklists (PhishDestroy and PhishingDB). The domain lacks an SSL certificate, a red flag for modern phishing sites that typically employ encryption to evade detection. Google Safe Browsing (GSB) has not yet listed the domain, indicating a potential gap in real-time detection coverage. As of the latest assessment, svi-wswhatsapp.cc has been taken offline, likely in response to security vendor detections and blocklist inclusions. However, the elevated risk remains due to the domain’s recent creation date, its association with a known high-risk registrar, and its hosting on an IP range with prior malicious activity. Users who may have interacted with the domain are advised to rotate credentials immediately, particularly for Gmail accounts, and monitor for unauthorized access. Organizations should update their blocklists to include the domain and its associated IP, while security teams are recommended to conduct retrospective analysis for any prior interactions with the infrastructure. The absence of an SSL certificate and the domain’s abrupt takedown suggest it was part of a short-lived campaign, but similar domains may re-emerge under altered naming conventions or infrastructure.