wa[.]buzz-whatapp[.]com[.]cn

The domain wa.buzz-whatapp.com.cn was registered on July 28, 2026 by 成都垦派科技有限公司 and is currently active. It resolves to the IPv4 address 192.197.113.111 and is served by the authoritative name servers ns1.kenpains.com and ns2.kenpains.com. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has taken remediation action.

VirusTotal analysis shows that 15 of 91 security vendors flag the domain as malicious, providing a moderate consensus of detection across multiple scanning engines. No additional public intelligence such as Safe Browsing, OTX, SSL certificate details, HTTP response codes, or page title information is available at this time, leaving the full payload and victim interaction vector unconfirmed. The limited detection footprint, combined with the recent creation date and the presence on a blocklist, suggests a deliberately short‑lived phishing infrastructure targeting users of WhatsApp‑related services.

Defenders should prioritize immediate DNS or firewall deny‑list rules for wa.buzz-whatapp.com.cn and its resolved IP 192.197.113.111, monitor for any outbound connections to the host, and consider adding the domain to internal threat‑intel feeds. Continuous re‑scanning of the domain through VirusTotal or similar platforms is advised to capture any evolution in detection scores. Network sensors should be tuned to alert on DNS queries for the domain or any HTTP(S) traffic directed at the IP address, and incident response teams should be prepared to investigate potential credential harvesting attempts that may originate from this infrastructure.