imsites-whatsapp[.]com[.]cn

Analysis of the domain imsites-whatsapp.com.cn confirms its classification as an active phishing site targeting WhatsApp users. Registered on June 17, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to IP address 156.239.9.106 and is currently flagged by 21 security vendors on VirusTotal. The page title, 'WhatsApp 网页版 - 官方入口 - 提供WhatsApp隔离环境长效保障,' explicitly references WhatsApp Web, suggesting an attempt to deceive users into believing the site is an official or secure portal for WhatsApp services. The domain appears on one security blocklist and has been included in five threat intelligence pulses on AlienVault OTX, indicating prior detection by the security community. Infrastructure analysis reveals the use of Nginx as the web server, with HSTS and HTTP/3 protocols enabled, which may be employed to lend an appearance of legitimacy. The SSL certificate is issued by Let's Encrypt, a common tactic among phishing sites to avoid browser warnings. Despite these technical measures, the domain has been assigned a trust score of 0/100 by Gridinsoft, reinforcing its malicious classification. Defenders should treat this domain as high-risk and prioritize blocking it at the network level. Given its active status and the presence of WhatsApp branding in the page title, the site is likely designed to harvest credentials or distribute malicious payloads under the guise of an official WhatsApp service. No evidence currently links this domain to a specific phishing kit or broader campaign, but its infrastructure and targeting align with common phishing tactics. Further monitoring is recommended to assess any shifts in its operational behavior or additional indicators of compromise.