app-qmt-whatshktw[.]com

Analysis of the domain app-qmt-whatshktw.com indicates a confirmed phishing campaign targeting Google brand identity, currently offline as of July 23, 2026. The domain was registered on October 8, 2025, through Dominet (HK) Limited, a registrar frequently associated with suspicious activity. Infrastructure analysis reveals the domain resolves to the IP address 103.254.73.181, hosted on AS205960 (HDTIDC LIMITED) in South Korea, a network segment previously linked to phishing and fraudulent operations. The domain employs nameservers ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainnamedns.com, a configuration commonly observed in coordinated phishing infrastructure. While the domain lacks an SSL certificate, increasing its detectability, the absence does not diminish its threat level.

The page title, 'whatsapp在線登錄電腦- 如何設置夜間模式：保護眼睛的最佳實踐,' suggests an attempt to impersonate WhatsApp functionality, though the declared brand target remains Google, indicating possible dual-purpose deception or misdirection. Detection metrics confirm elevated risk: the domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 15 of 95 security vendors in available scans. Gridinsoft and Scamadviser both assign a trust score of 1/100, reinforcing its malicious classification. AlienVault OTX records the domain in 16 threat intelligence pulses, further corroborating its association with known malicious campaigns.

Defenders should treat this domain as a confirmed phishing asset. Network-level blocking of 103.254.73.181 and associated nameservers is recommended. Organizations targeting Chinese-speaking users or operating in regions where WhatsApp is prevalent should prioritize monitoring for similar impersonation attempts, particularly those leveraging localized page titles to enhance credibility. The domain's current offline status does not preclude future reactivation; continuous monitoring of the IP and registrar is advised.