qd[.]wss382[.]com

qd.wss382.com is a newly registered subdomain created on 19 December 2025 and currently points to the IPv4 address 38.45.123.206. The address is announced by AS9294 belonging to GNET INC. and is geolocated in Hong Kong. The domain is delegated to the authoritative name servers ns1.julydns.com and ns2.julydns.com. No TLS certificate has been observed for the host, and the site is presently taken offline, returning no HTTP response.

Reputation data shows the domain appears on a single security blocklist and received a Gridinsoft trust score of 0 out of 100, indicating a highly suspicious rating. VirusTotal analysis reports that 17 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion. The domain is listed by PhishDestroy as a blocked resource. Registration details list July Name Limited as the registrar, suggesting a commercial registration service. The threat profile indicates brand impersonation targeting WhatsApp, as explicitly noted in the intelligence feed.

No additional artifacts such as page titles, login forms, or malicious payloads have been disclosed, leaving the exact phishing methodology undetermined. Defenders should continue to block the resolved IP and the domain at DNS and network layers, incorporate the host into URL filtering rules, and monitor for any re‑activation attempts. Further investigation is advised to capture HTTP traffic if the site becomes reachable, to retrieve any page content that could confirm the impersonation technique. The presence on multiple vendor blocklists and the low trust score warrant elevated vigilance for any downstream abuse targeting WhatsApp users.