fcn[.]weppb[.]icu

Analysis as of July 23, 2026 indicates that the domain fcn.weppb.icu is associated with a brand‑impersonation campaign targeting WhatsApp users. The domain was registered on 21 February 2026 and presently reports an offline HTTP status. DNS resolution historically pointed to the IPv4 address 20.255.98.160, which belongs to the Microsoft Corporation network (ASN 8075) and is geolocated in Hong Kong. The TLS certificate presented by the host is identified as "R12," but no further certificate details are available. The page title returned from the web server is "Whatsapp," matching the declared brand target of the campaign.

Threat intelligence feeds show that 16 of 93 antivirus and URL‑reputation engines on VirusTotal flagged the domain as malicious, and the site is listed on a single security blocklist. It has been actively blocked by the PhishDestroy filtering service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. The campaign is classified as a brand‑impersonation scam, specifically attempting to lure victims by masquerading as WhatsApp.

The limited infrastructure footprint—single domain, single IP, and a recent registration—suggests a short‑lived operation typical of opportunistic phishing kits. However, the use of a Microsoft‑owned IP range may provide temporary credibility and could be leveraged to bypass naïve network controls. Defenders should add fcn.weppb.icu to DNS and URL blocklists, monitor traffic to 20.255.98.160 for any residual connections, and consider applying broader endpoint protection rules that flag any interaction with the domain or its associated IP. Ongoing observation of related WHOIS changes, SSL certificate renewals, or new sub‑domains is advisable to detect potential re‑use of the same hosting assets.