app-vvp-whatshktw[.]com

Analysis of app-vvp-whatshktw.com indicates a confirmed brand impersonation phishing domain targeting Facebook users, currently offline as of July 23, 2026. The domain was registered on October 8, 2025, through Dominet (HK) Limited, with nameservers ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainnamedns.com. Infrastructure resolves to IP 103.254.73.198, hosted on AS205960 (HDTIDC LIMITED) in South Korea. No SSL certificate was detected, increasing the risk of unencrypted credential harvesting.

The page title, 'WhatsApp web- 如何進行多方通話：輕松實現團隊會議,' suggests an attempt to deceive users into believing the site is associated with WhatsApp, despite the domain being explicitly flagged for Facebook impersonation. This mismatch between branding and page content may indicate a broader phishing campaign or a dynamically generated lure. Detection data shows the domain is flagged by 16 of 95 security vendors on VirusTotal, appears in 16 AlienVault OTX threat intelligence pulses, and is listed on one security blocklist (PhishDestroy). Scamadviser and Gridinsoft both assign a trust score of 1/100 and 0/100, respectively, reinforcing its malicious classification.

Defenders should treat this domain as high-risk for credential theft or social engineering. Recommended actions include blocking the domain and IP at network perimeters, monitoring for related infrastructure (e.g., nameservers, registrar, or hosting provider), and alerting users to the impersonation tactic. While the domain is currently offline, historical DNS records and WHOIS data should be preserved for forensic analysis. Further investigation into the hosting provider (HDTIDC LIMITED) may reveal additional compromised or malicious domains sharing the same infrastructure.