whatscyy[.]cc

This domain, whatscyy.cc, is flagged as a brand impersonation threat specifically targeting Gmail. Analysis confirms the domain is currently offline, though prior activity involved presenting itself as a legitimate Gmail service to deceive users into disclosing credentials or other sensitive information. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited on October 11, 2025, and resolves to the IP address 103.99.210.197, hosted under AS205960 HDTIDC LIMITED in South Korea. No SSL certificate was detected, increasing the risk of unencrypted data interception. The domain is flagged by 14 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and PhishingDB. The page title, "whatsapp網頁版直接登錄| 聊天記錄的安全性分析：保護你的數據," suggests an attempt to mimic communication platforms, further aligning with credential theft tactics. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and associated IP (103.99.210.197) at the network level. Users should verify the legitimacy of any communication claiming to be from Gmail by checking the sender’s domain and enabling multi-factor authentication. Security teams are recommended to monitor for related domains registered through the same registrar or resolving to the same IP range.