cwhtspp[.]cc

The domain cwhtspp.cc has been identified as a high-risk brand impersonation threat specifically targeting WhatsApp users. Analysis confirms the domain was designed to mimic the legitimate WhatsApp Web service, a tactic commonly employed to harvest credentials or distribute malicious payloads. As of the latest verification, the domain has been taken offline, though prior activity remains a concern for retrospective security reviews. Technical indicators reveal the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. Infrastructure analysis shows the domain was registered on December 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolved to the IP address 35.188.173.136, hosted on Google LLC’s AS396982 network in the United States. Notably, the domain lacked an SSL certificate, a red flag for user security, and was present on at least one security blocklist. Google Safe Browsing also explicitly flagged the domain as phishing, further corroborating its malicious intent. Current status confirms cwhtspp.cc is offline, reducing immediate exposure risk. However, organizations and users are advised to treat any prior interactions with the domain as compromised. Security teams should block the domain and its associated IP at the network perimeter, update endpoint protection rules to include this indicator of compromise, and monitor for any residual connections or credential reuse attempts. Users who may have accessed the domain should reset their credentials for WhatsApp and any other services where passwords may have been reused. Proactive threat hunting for related infrastructure, such as domains registered through the same registrar or resolving to the same IP, is recommended to identify potential secondary threats.