yjr-wswhatsapp[.]cc

yjr-wswhatsapp.cc is an inactive domain that was registered on October 02, 2025 through Dominet (HK) Limited. The authoritative name servers listed are ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainname. DNS resolution points to the IP address 103.80.133.109, which belongs to AS205960, HDTIDC LIMITED, and is geolocated in South Korea. No TLS certificate was observed for the host, indicating that HTTPS is not offered. The web page title returned by the server is “whatsapp网页版直接登录| 如何进行视频通话设置：畅享面对面沟通”, which contains references to WhatsApp but the domain is classified as a Google impersonation campaign.

The threat profile is identified as Social Media Phishing, targeting Google users. Reputation services show a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, and VirusTotal reports that 18 of 95 scanned security vendors flagged the host as malicious. AlienVault OTX records the domain in 17 distinct threat‑intelligence pulses.

The domain is currently taken offline, but historical evidence suggests it was used to lure victims into providing credentials or personal information under the guise of a legitimate Google service. Defenders should continue to monitor DNS queries for the listed name servers and the associated IP address, enforce strict outbound filtering for HTTP traffic to unknown Chinese‑language sites, and ensure that URL filtering solutions include the domain in their block lists. Because the site is no longer reachable, any ongoing investigations should focus on correlating logs from the time window after registration to identify potential victim activity. Additional analysis is required to confirm the exact phishing page content and to determine whether any malicious payloads were delivered.