wechath5[.]westernunion[.]cloud

The domain wechath5.westernunion.cloud is identified as a generic phishing site, targeting the Western Union brand. No specific drainer kit has been detected in the infrastructure. The domain's primary objective appears to be to trick users into providing sensitive information such as login credentials or personal data.

Analysis indicates that the domain has been flagged by 14 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion. The domain is registered through DNSPod, Inc., and resolves to an IP address located in Germany (23.45.102.21), which is managed by Akamai International, BV. The domain was created on May 15, 2026, and the SSL certificate is issued by DNSPod, Inc. / DNSPod DV TLS RSA CA G1. The domain is currently listed on one security blocklist, further indicating its malicious intent.

The domain is currently offline, which reduces the immediate risk to potential victims. However, the infrastructure may still pose a threat as it can be brought back online at any time. It is recommended that network administrators and security teams continue to monitor this domain and apply necessary blocks to prevent any future phishing attempts. Users should be educated on the signs of phishing attacks and encouraged to verify the legitimacy of any Western Union-related communications before providing any sensitive information.