whatrtsapp[.]us[.]cc

This domain, whatrtsapp.us.cc, poses a direct threat as a brand impersonation scheme targeting WhatsApp users. Analysis indicates the domain was designed to mimic the official WhatsApp Web interface, likely to deceive users into entering credentials or downloading malicious content. The page title, 'WhatsApp Web,' reinforces the deception by replicating the legitimate service's branding, increasing the likelihood of successful social engineering attacks. Given the elevated risk level, this domain likely facilitated credential theft or malware distribution under the guise of a trusted communication platform. Infrastructure analysis reveals multiple technical indicators supporting the fraudulent nature of whatrtsapp.us.cc. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 23.145.136.77, hosted in Japan under AS209242 Cloudflare London, LLC. Notably, the domain lacks an SSL certificate, a red flag for secure connections. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The creation date discrepancy—registered in 2026—further suggests an attempt to evade detection by leveraging an unconventional registration timeline. Users who visited whatrtsapp.us.cc should take immediate remedial actions to mitigate potential risks. First, any credentials entered on the site must be changed immediately across all platforms where they were reused. Devices used to access the domain should undergo a thorough malware scan using updated security tools to detect and remove any downloaded payloads. Additionally, users should monitor their accounts for unauthorized activity and enable multi-factor authentication where available. If financial or sensitive personal information was submitted, affected individuals should report the incident to relevant authorities and consider credit monitoring services to prevent identity theft.