tpg-wswhatsapp[.]cc

This domain is flagged as an elevated-risk brand impersonation threat targeting WhatsApp Web login credentials. Analysis indicates the infrastructure is designed to deceive users into submitting authentication details through a fabricated login interface, while also promoting file-sharing capabilities in Chinese-language text. The specific threat involves credential theft, likely followed by unauthorized account access or further social engineering attacks. Infrastructure analysis reveals multiple high-risk indicators. The domain tpg-wswhatsapp.cc was registered on October 02, 2025, through Dominet (HK) Limited, a registrar frequently associated with fraudulent activity. It resolves to the IP address 103.99.210.145, hosted in South Korea under AS205960 (HDTIDC LIMITED), an autonomous system with a history of malicious traffic. VirusTotal detection rates show 18 out of 95 security vendors flagging the domain, while it appears on two security blocklists: PhishDestroy and PhishingDB. The absence of an SSL certificate further undermines trust, as encrypted connections are standard for legitimate authentication portals. The page title, 'whatsapp web login| 如何进行文件分享：支持多种文件格式,' explicitly targets Chinese-speaking users, suggesting a localized phishing campaign. Mitigation steps for this threat type include immediate domain blocking at the network level, particularly for endpoints resolving to 103.99.210.145 or associated autonomous systems. Organizations should update email and web filtering rules to quarantine messages containing links to tpg-wswhatsapp.cc or similar impersonation domains. End-user education should emphasize verifying SSL certificates and domain authenticity before entering credentials, especially for services like WhatsApp Web. Security teams are advised to monitor for unauthorized access attempts from the IP range 103.99.210.0/24 and investigate any connections to the registrar Dominet (HK) Limited for potential fraudulent domain registrations. Given the domain's current offline status, continuous monitoring for reactivation or domain squatting variants is recommended.