zh-whatsapp-hk[.]com[.]cn

This domain is flagged for elevated-risk brand impersonation, specifically targeting WhatsApp users through a fraudulent web interface. Analysis indicates the domain, zh-whatsapp-hk.com.cn, was designed to deceive users into believing they are accessing an official WhatsApp web client, as evidenced by its page title: 'WhatsApp 網頁版｜桌面瀏覽器會話與跨裝置同步體驗.' The threat type centers on credential harvesting and potential account takeover, leveraging the trust associated with the WhatsApp brand. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 21, 2026, through 阿里云计算有限公司（万网）, a registrar commonly exploited for malicious activities. It resolves to the IP address 156.239.15.48, hosted under AS154321 (CORENET CLOUD SDN. BHD.) in Hong Kong. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate status remains unknown, further complicating trust assessment. The domain is currently offline, but its infrastructure and historical activity warrant continued scrutiny. Mitigation steps for this threat type include immediate domain blacklisting at the network and endpoint levels, particularly for organizations with users in regions where Traditional Chinese is prevalent. Security teams should monitor for residual DNS queries or cached resolutions tied to 156.239.15.48 and the domain itself. User education campaigns should emphasize verifying official WhatsApp web domains (e.g., web.whatsapp.com) and recognizing impersonation tactics, such as mismatched URLs or unsolicited login prompts. Given the domain’s creation date anomaly (2026), administrators should also investigate potential registrar abuse or domain spoofing techniques. Proactive hunting for related infrastructure, such as sibling domains or shared hosting IPs, is recommended to preemptively disrupt similar campaigns.