web[.]app-www-whatsapp[.]com[.]cn

This domain, web.app-www-whatsapp.com.cn, is identified as a brand impersonation threat targeting WhatsApp, a messaging platform owned by Facebook. Analysis indicates the site presented itself as a legitimate WhatsApp Web portal, using the page title 'WhatsApp Web - 安全可靠的通讯平台' to deceive users into believing they were accessing an official and secure communication platform. No evidence of a drainer kit or cryptocurrency wallet interaction was observed in the available data, though the domain's structure and branding suggest a focus on credential harvesting or account compromise. Infrastructure analysis reveals the domain was registered on February 21, 2026, through 成都西维数码科技有限公司, a registrar based in China. The domain resolves to the IP address 154.221.9.153, located in Hong Kong under AS137951 (ASLINE LIMITED). At the time of assessment, 21 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and was blocked by at least one threat intelligence feed. No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data in transit. The domain does not appear on Google Safe Browsing at the time of this report. The domain is currently offline, reducing immediate exposure risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. The elevated risk level is attributed to the domain's convincing impersonation of WhatsApp, lack of encryption, and prior detection by multiple security vendors. Users who accessed the site are advised to reset credentials for associated accounts, particularly if login attempts were made. Organizations should monitor for signs of credential reuse or unauthorized access linked to this domain. The registrar and hosting provider have not publicly disclosed remediation actions, leaving the infrastructure available for potential reuse.