whatsapp[.]nr[.]hl[.]cn

The domain whatsapp.nr.hl.cn was registered on February 28, 2026 by 成都垦派科技有限公司 and is currently active. DNS resolution points to the IPv4 address 154.195.71.89, with authoritative name servers ns1.kenpains.com and ns2.kenpains.com. The public page title observed is "WhatsApp网页版 - 畅聊无界限," indicating an attempt to lure victims with a Chinese-language reference to WhatsApp Web. Threat intelligence sources classify the site as a generic phishing operation and assign a high risk rating.

VirusTotal analysis shows that 12 of 91 security vendors flagged the domain, confirming malicious behavior. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment of active abuse. While the underlying hosting provider, geographic location of the IP, and TLS certificate details are not disclosed in the available data, the combination of recent registration, targeted name‑server configuration, and multiple vendor detections suggests a purpose‑built phishing infrastructure rather than an incidental compromise. Defenders should immediately block DNS resolution for whatsapp.nr.hl.cn and any traffic to 154.195.71.89 at perimeter devices.

Adding the domain to internal URL filtering, email gateway, and endpoint protection blocklists will reduce exposure. Continuous monitoring of DNS query logs for the domain and its name servers is advised, as well as periodic re‑scans on VirusTotal or similar platforms to capture any changes in detection status. Organizations that rely on WhatsApp services should educate users about unsolicited login prompts and enforce multi‑factor authentication where possible.