whatssai[.]cc

Analysis indicates that the domain whatssai.cc was registered on 11 October 2025 through Dominet (HK) Limited and is currently marked offline. The site resolves to the IP address 91.204.227.136, which belongs to the AS205960 HDTIDC LIMITED network located in South Korea. No SSL certificate is presented for the host, and the Gridinsoft trust score for the domain is recorded as 0 out of 100, reflecting a lack of trustworthiness. The infrastructure employs four nameservers – ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com and ns4.domainname – a pattern commonly observed in malicious hosting arrangements.

Content analysis reveals the page title “whatsapp网页版直接登录- 文件传输限制：了解支持的文件类型”, clearly targeting the WhatsApp brand and indicating a brand‑impersonation campaign. The domain appears on one security blocklist and has been cited in seventeen AlienVault OTX threat intelligence pulses. VirusTotal scans show that fifteen of ninety‑five security vendors flagged the domain, reinforcing its malicious reputation. Additionally, the anti‑phishing service PhishDestroy has listed the domain as blocked.

Although the site is offline, the observable indicators suggest that the domain was used to lure users into believing they were accessing an official WhatsApp web login page. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor the associated IP range for any resurgence of activity, and update detection signatures to include the observed page title and the specific nameserver set. Threat intelligence feeds should be refreshed with the latest OTX pulse references, and any future registrations that reuse the same registrar or naming pattern should be scrutinised. Continuous verification of SSL deployment and trust‑score metrics is advised to catch similar impersonation attempts promptly.