web[.]whatsapp[.]com[.]mk[.]hl[.]cn

The domain web.whatsapp.com.mk.hl.cn has been identified as engaging in phishing activities, specifically related to brand impersonation. This domain was noted for attempting to mimic legitimate services, potentially misleading users into divulging sensitive information. The threat has been classified under generic phishing, signifying a broad range of potential deceptive practices aimed at capturing user credentials or spreading malware.

Technical analysis of the domain reveals several key indicators. The domain resolves to the IP address 168.76.145.218, which is located in South Africa, specifically associated with the Free State Education Department. The SSL certificate for this domain was issued by Let's Encrypt, labeled as R13. According to VirusTotal, the domain has been flagged by 21 out of 95 security vendors, indicating a significant level of detection by the cybersecurity community. The domain was created on March 27, 2026, and has appeared on at least one security blocklist, further corroborating its malicious intent.

Currently, the domain is offline, and proactive measures have been taken to mitigate its threat potential. Services like PhishDestroy have blocked access to this domain, reducing the risk of user exposure. Despite its offline status, the domain's previous activities necessitate ongoing vigilance, as similar attacks could target unsuspecting users. It is recommended that individuals remain cautious of unsolicited communications and verify the legitimacy of web addresses before entering any personal information. Organizations should continue to monitor for similar threats and update their security protocols to manage emerging risks effectively.