app-ikq-whatshktw[.]com

This domain, app-ikq-whatshktw.com, operates as a credential harvesting platform specifically designed to impersonate Facebook login interfaces. Analysis of the page title, 'whatsapp有網頁版的嗎| 多設備同步：隨時隨地保持信息更新,' indicates a targeted approach toward Chinese-speaking users, presenting a fraudulent WhatsApp Web login portal to capture Facebook account credentials. The infrastructure mimics legitimate social media authentication flows, likely employing form submission scripts to exfiltrate entered usernames and passwords to attacker-controlled endpoints. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on October 08, 2025, through Dominet (HK) Limited and currently resolves to the IP address 103.99.210.71, hosted on AS205960 (HDTIDC LIMITED) in South Korea. Security vendors have flagged this domain at a rate of 17/95 on VirusTotal, while it appears on 2 distinct security blocklists, including PhishDestroy and PhishingDB. Notably, the domain lacks any SSL certificate, exposing user submissions to interception during transmission. Users who visited app-ikq-whatshktw.com should immediately revoke any entered credentials from their Facebook accounts and enable multi-factor authentication. Network administrators are advised to block the IP address 103.99.210.71 and monitor for connections to the domain across their environments. Given the domain's current offline status, organizations should remain vigilant for similar infrastructure patterns, including newly registered domains through Dominet (HK) Limited and hosting on AS205960, as threat actors frequently rotate domains while maintaining consistent hosting providers.