whatsapp[.]ho[.]hl[.]cn

This domain, whatsapp.ho.hl.cn, is a phishing site designed to impersonate the official WhatsApp Web login portal. Analysis indicates the site targets users by presenting a fraudulent interface that mimics the legitimate WhatsApp Web service, specifically displaying a page title in Chinese: 'WhatsApp Web - 安全、可靠、便捷的消息应用.' The primary threat posed by this domain is the theft of user credentials, including usernames, passwords, and potentially two-factor authentication codes, which could lead to unauthorized access to victims' accounts and subsequent exploitation for further malicious activities such as spam, fraud, or data exfiltration. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on February 28, 2026, through 成都垦派科技有限公司, a registrar often associated with suspicious domains. It resolves to the IP address 217.114.47.164 and employs Nginx as its web server, along with HSTS to enforce HTTPS connections. The domain is flagged by 23 out of 95 security vendors on VirusTotal, and it appears on one security blocklist, specifically PhishDestroy. Additionally, the domain's trust score is rated at 0/100 by Gridinsoft, further corroborating its malicious nature. The use of a Let's Encrypt SSL certificate, while common among legitimate sites, is frequently exploited by threat actors to lend an air of legitimacy to phishing pages. Users who have visited whatsapp.ho.hl.cn or entered credentials on this site should take immediate action to mitigate potential risks. First, they should change their WhatsApp password and enable two-factor authentication if not already active. It is also recommended to review recent account activity for any unauthorized logins or messages sent from the account. Users should scan their devices for malware using updated security tools, as phishing sites may deploy additional payloads. Finally, affected individuals should report the incident to their organization's security team or a trusted cybersecurity provider to assist in further investigation and remediation efforts.