cm-whatsapp[.]com

This domain, cm-whatsapp.com, poses a direct brand impersonation threat targeting WhatsApp users under the guise of a security verification portal. Analysis of the page title, 'whatsApp安全检测中心' (WhatsApp Security Detection Center), indicates an attempt to deceive users into believing the site is an official WhatsApp security or account verification service. Such impersonation schemes are commonly used to harvest login credentials, distribute malware, or facilitate social engineering attacks by exploiting trust in the targeted brand. The domain’s infrastructure and content are designed to mimic legitimate WhatsApp communications, increasing the likelihood of user engagement with malicious intent. Infrastructure analysis reveals multiple high-risk indicators associated with cm-whatsapp.com. The domain was registered on November 17, 2025, through Metaregistrar BV, a registrar frequently observed in fraudulent registrations due to its accessibility and bulk registration capabilities. It resolves to the IP address 46.3.112.104, located in the United States, and currently lacks an SSL certificate, a critical security red flag for any site handling user data. Security vendors on VirusTotal have flagged the domain as malicious, with 17 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist, further corroborating its malicious classification. Users who visited cm-whatsapp.com should take immediate action to mitigate potential risks. If any credentials or personal information were entered on the site, affected accounts should be secured by changing passwords and enabling multi-factor authentication where available. Devices used to access the domain should be scanned for malware using updated security tools to detect any potential infections. Users are also advised to monitor their accounts for unauthorized activity and report any suspicious behavior to the legitimate service provider. Given the domain’s offline status, continued vigilance is recommended, as threat actors may re-deploy similar infrastructure under different domains.