pc[.]whatscoa[.]cc

This report analyzes the domain pc.whatscoa.cc, which was identified as an impersonation threat targeting the WhatsApp brand. The site’s page title, “WhatsApp官方網站 - - 聊天記錄備份：保護重要信息的最佳方法,” falsely claims to be the official WhatsApp website, specifically promoting a chat record backup feature. This constitutes a brand impersonation scam, likely designed to deceive users into providing sensitive information or downloading malicious content under the guise of a legitimate backup service.

Technical evidence confirms the malicious nature of the site. VirusTotal detections show 14 out of 95 security vendors flagged the domain, with specific alerts from ADMINUSLabs, BitDefender, CyRadar, ESET, and Forcepoint ThreatSeeker. The domain is registered via Dominet (HK) Limited and resolves to IP address 103.99.210.65, located in South Korea and hosted by AS205960 HDTIDC LIMITED. The domain was created on 2025-10-11 and lacks SSL certificate, indicating no encrypted connection. The site’s nameservers are ns1.domainnamedns.com and ns2.domainnamedns.com. GridinSoft trust rating is 0 out of 100, and the DOM risk score is 10, both indicating high risk.

The domain is currently offline, but the risk level remains elevated due to its recent creation, lack of encryption, and high detection rate by security vendors. With two blocklists flagging the domain, it poses a significant threat if reactivated, as it targets users seeking WhatsApp backup services.