fjjf-wahtsapp[.]com

Analysis of fjjf-wahtsapp.com shows a short‑lived domain created on 28 September 2025 and currently taken offline. The site was hosted on the IP address 103.80.133.24, which belongs to the AS205960 HDTIDC LIMITED network in South Korea. DNS resolution used the authoritative name servers n1.xundns.com and n2.xundns.com. The SSL certificate presented by the site was issued by Let’s Encrypt (R12), indicating a valid TLS handshake but offering no guarantee of legitimacy. HTTP headers revealed the presence of Nginx and HTTP Strict Transport Security, while Baidu Analytics (百度统计) was detected, suggesting the use of a third‑party tracking service.

Brand‑targeting evidence includes the page title “whatsapp官网登录入口 - 零障碍快速通讯 | WhatsApp” and the classification of the campaign as a brand impersonation of WhatsApp. The domain appears on one security blocklist and has been blocked by the PhishDestroy service. In the Open Threat Exchange, the domain is referenced in sixteen separate pulses, reinforcing its recognition across the threat‑intel community. VirusTotal analysis returned fifteen positive detections out of ninety‑five scanned scanners, indicating a moderate level of malicious classification. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 / 100 and Gridinsoft 0 / 100, reflecting the consensus that the site is highly untrustworthy.

Registration was performed through GKG.NET, INC., but no further registrant details are disclosed. The available data confirms that the infrastructure was intentionally short‑lived and that the domain was used to impersonate WhatsApp login pages. However, the exact payload, credential‑harvesting mechanism, and any post‑compromise activity remain unknown because the site is offline and no page content beyond the title has been captured.