os-web-whatsapp[.]hl[.]cn

This domain is assessed as a generic phishing infrastructure impersonating WhatsApp Web services. The page is designed to mimic a legitimate messaging web login interface, likely aiming to harvest user credentials or session tokens through deceptive authentication prompts. The infrastructure aligns with credential theft campaigns that rely on visual replication of trusted platforms to induce login submissions.

Technical telemetry shows the domain was created on February 22, 2026 and is currently taken offline. VirusTotal analysis reports 26/95 security vendors flagging the domain as malicious or suspicious. The registrar is Alibaba Cloud (China), and the domain resolves to IP 168.76.144.219 hosted under AS137951 ASLINE LIMITED in Hong Kong. The domain appears on 1 security blocklist and uses a Let's Encrypt R12 SSL certificate, which is commonly observed in rapidly deployed phishing infrastructure.

If users interacted with this domain, credential compromise risk should be assumed. Immediate remediation includes changing affected account passwords, terminating active sessions on all devices, and enabling multi-factor authentication. Any linked accounts or reused passwords should be updated, and system scans should be performed to detect potential secondary compromise vectors such as session hijacking or token theft.