app-qay-whatsappcc[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Facebook users through a fraudulent WhatsApp Web interface. The site presents itself as a legitimate WhatsApp service page with the title 'web.whatsapp- 使用限制：避免常见误区与问题,' designed to harvest login credentials by exploiting user trust in the WhatsApp brand while covertly redirecting victims to Facebook authentication portals. Analysis indicates the domain app-qay-whatsappcc.com was registered on October 05, 2025, through Dominet (HK) Limited and resolves to IP address 103.80.133.37, hosted on AS205960 (HDTIDC LIMITED) in South Korea. The infrastructure lacks SSL encryption, increasing exposure to man-in-the-middle interception. Security vendors on VirusTotal flagged the domain at a 17/95 detection rate, while two independent blocklists (PhishDestroy and PhishingDB) have already classified it as malicious. The absence of HTTPS and its presence on multiple threat intelligence feeds further corroborate the elevated risk classification. Organizations and users should implement the following mitigation measures specific to this credential-harvesting threat. First, block the domain app-qay-whatsappcc.com and its resolving IP 103.80.133.37 at the network perimeter. Second, deploy browser-based warnings for users attempting to access WhatsApp Web through unofficial domains, particularly those containing non-standard subdomains like 'app-qay.' Third, monitor authentication logs for failed or anomalous login attempts originating from the identified IP range. Finally, educate users on identifying impersonation tactics, such as scrutinizing domain names for subtle misspellings and verifying HTTPS presence before entering credentials.