jl-np-whatsapp[.]com[.]cn

This domain, jl-np-whatsapp.com.cn, operates as a fraudulent WhatsApp login portal designed to harvest user credentials through brand impersonation. The site presents a localized Chinese interface with the page title 'WhatsApp | 安全可靠的免费私密消息和通话,' falsely claiming to offer secure messaging services. Analysis indicates the infrastructure is specifically engineered to target users seeking WhatsApp access, likely distributing phishing kits that capture login credentials and session tokens for account takeover or further social engineering attacks. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 25, 2026, through 成都垦派科技有限公司, a registrar frequently associated with abusive registrations. VirusTotal detection shows 24 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The site resolves to IP address 43.226.17.32 (AS64050, BGP Network Limited, South Korea), an autonomous system previously linked to phishing campaigns. The SSL certificate is issued by Let's Encrypt (R12), a common choice for threat actors due to its free and automated issuance process. Users who visited jl-np-whatsapp.com.cn should immediately revoke any entered credentials and enable multi-factor authentication on their WhatsApp accounts. All active sessions should be terminated through the official WhatsApp application or web interface. If financial or personal information was submitted, affected parties should monitor accounts for unauthorized activity and consider placing fraud alerts with relevant institutions. Browser data and cached credentials associated with this domain should be cleared to prevent persistent access attempts. Organizations should update network security policies to block the domain, its resolving IP, and associated autonomous system ranges to prevent further exposure.