whatsapplnfo[.]blogspot[.]com

This domain, whatsapplnfo.blogspot.com, operates as a deceptive WhatsApp news portal designed to distribute generic phishing content. The site mimics legitimate news sources about the messaging platform, likely aiming to harvest user credentials, spread malware, or redirect visitors to fraudulent schemes under the guise of official updates or exclusive content. The page title, 'Whatsapp Noticias. Todo sobre WhatsApp,' reinforces the illusion of authenticity, targeting Spanish-speaking users who may unknowingly engage with malicious links or embedded forms. Analysis of the infrastructure reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious purposes. Security vendors on VirusTotal flagged the domain at a ratio of 11/95, indicating moderate but consistent detection across engines. The site resolves to the IPv6 address 2a00:1450:4001:816::2001, hosted on Google LLC’s AS15169 infrastructure in Germany. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE2), does not mitigate its malicious classification. Users who visited whatsapplnfo.blogspot.com should assume potential exposure to phishing vectors. Immediate actions include resetting passwords for any accounts accessed after visiting the site, particularly WhatsApp or associated email addresses. Devices used to access the domain should undergo a full antivirus scan to detect and remove any downloaded payloads. Browser data, including cookies and cached files, should be cleared to eliminate residual tracking mechanisms. If financial or personal information was entered, affected parties should monitor accounts for unauthorized activity and consider reporting the incident to relevant cybersecurity authorities.