wlntasaqp-kf[.]com

Analysis of wlntasaqp-kf.com indicates a confirmed brand impersonation scam targeting WhatsApp users, with elevated risk due to infrastructure and detection patterns. The domain, registered on October 20, 2025, through Dominet (HK) Limited, resolves to IP 43.156.253.37, hosted in Singapore under AS132203 (Tencent Building). No SSL certificate was detected, increasing susceptibility to interception or tampering. The page title explicitly displays 'WhatsApp,' aligning with the reported scam type of brand impersonation, though the exact content or attack vector remains unverified due to the site's offline status as of July 23, 2026. Security vendor detections are notable: 16 of 95 engines on VirusTotal flagged the domain, while AlienVault OTX lists it in two threat intelligence pulses, suggesting prior malicious activity.

The domain appears on one security blocklist and is blocked by PhishDestroy. Nameservers (ns7.alidns.com, ns8.alidns.com) are associated with Alibaba Cloud, a common hosting choice for both legitimate and malicious infrastructure. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. Defenders should treat this domain as compromised.

While the site is offline, historical resolution to 43.156.253.37 and its registration details provide actionable indicators for network-level blocking. The combination of brand impersonation, lack of SSL, and detection by multiple vendors warrants immediate inclusion in deny lists. Further investigation into the hosting provider (Tencent/AS132203) may reveal additional linked infrastructure, though no direct evidence of a broader campaign is currently available. Monitor for re-activation or domain reuse under altered nameservers or IPs.