whatsapp-me[.]cn-chat-whatapps[.]gd[.]cn

Analysis of the domain whatsapp-me.cn-chat-whatapps.gd.cn indicates it is an active phishing infrastructure targeting WhatsApp users, registered on July 01, 2026, through 北京新网数码信息技术有限公司. The domain resolves to the IP address 156.239.9.106 and utilizes nameservers dm1.longmingdns.com and dm2.longmingdns.com, which may be associated with malicious hosting patterns. As of July 21, 2026, the domain appears on one security blocklist and is flagged by 13 of 95 security vendors on VirusTotal, confirming its detection as malicious by multiple engines. The domain remains active, with no evidence of takedown or sinkholing. Infrastructure analysis reveals the domain was created recently, aligning with common phishing campaign timelines where newly registered domains are used to evade reputation-based filters. The use of subdomains mimicking WhatsApp branding (e.g., 'whatsapp-me', 'cn-chat-whatapps') suggests an intent to deceive users into believing the site is affiliated with the legitimate messaging platform. However, the exact content or phishing kit in use has not been analyzed, and no page title or HTTP response details are available to confirm the specific lure or payload. Defenders should treat this domain as high-risk and implement blocking at the DNS or network level. Monitoring for connections to 156.239.9.106 or the associated nameservers may help identify compromised hosts within an environment. Given the domain's recent registration and active status, further investigation into the hosting provider and registrar is recommended to assess potential abuse reporting or takedown actions. No evidence links this domain to broader campaign infrastructure beyond the provided indicators.