uw-ya-whatsapp[.]com[.]cn

The domain uw-ya-whatsapp.com.cn is identified as a high-risk phishing site specifically designed to impersonate WhatsApp login pages. Analysis indicates this is a fake login credential harvesting operation, targeting users under the guise of the legitimate messaging platform. The domain is currently offline, but prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered through 成都垦派科技有限公司 on February 25, 2026, an unusually future-dated creation that may indicate domain spoofing or registry manipulation. It resolved to the IP address 43.226.17.32, hosted on AS64050 (BGP Network Limited) in South Korea. The domain appears on one security blocklist and is flagged by 24 of 95 security vendors on VirusTotal. Google Safe Browsing classifies it as a phishing threat, and it used a Let's Encrypt SSL certificate (R12) to appear legitimate. The page title, 'WhatsApp | 安全可靠的免费私密消息和通话,' directly mimics WhatsApp's branding in Chinese. The domain has been taken offline, but similar infrastructure may reappear under different names. Users are advised to verify domain authenticity before entering credentials, particularly for messaging platforms. Organizations should block the domain and its associated IP (43.226.17.32) at the network level. Security teams should monitor for future registrations from the same registrar or hosting provider, as these may indicate continued malicious activity. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended.