it-web-whatsapp[.]hl[.]cn

The domain it-web-whatsapp.hl.cn has been assessed as posing an elevated risk due to its classification as a generic phishing threat. Analysis indicates that the domain was designed to mimic the legitimate WhatsApp Web service, potentially to deceive users into providing sensitive information.

Infrastructure analysis reveals that the domain it-web-whatsapp.hl.cn is associated with the IP address 168.76.144.218, which is located in Hong Kong (HK) under the AS137951 ASLINE LIMITED Autonomous System. The domain was registered through Alibaba Cloud (China) on February 22, 2026. VirusTotal reported that 26 out of 95 security vendors flagged the domain, indicating a moderate level of detection and suspicion. The domain also appears on one known security blocklist and has a trust score reflecting its malicious nature. The SSL certificate for the domain was issued by Let's Encrypt, which is common for both legitimate and phishing sites, but the use of a reputable certificate authority can lend a false sense of security to unsuspecting users.

To mitigate the risks associated with this generic phishing threat, it is recommended that users avoid clicking on any links or entering personal information on any website that appears suspicious, even if it displays a valid SSL certificate. Organizations should update their security policies to include the domain it-web-whatsapp.hl.cn in their blocklists and educate employees on recognizing phishing attempts. Network administrators should monitor for any attempts to access this domain and implement DNS filtering to prevent such access.