of-whatapp[.]top

This domain, of-whatapp.top, is actively engaged in a phishing campaign designed to impersonate the official WhatsApp Web platform. The site presents a fraudulent login interface under the title 'WhatsApp网页版 - 即时通讯,' targeting users who seek to access WhatsApp through a web browser. The objective of this campaign is to deceive victims into entering their credentials, which are subsequently captured by the threat actors for unauthorized access, account takeover, or further malicious activities such as spam propagation or financial fraud. Analysis of the domain infrastructure reveals multiple indicators of malicious intent. The domain was registered on June 28, 2026, through Vantage of Convergence Chengdu Technology Co., Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 154.206.233.25, which has been linked to other phishing and fraudulent activities. Detection engines on VirusTotal flag the domain as malicious, with 13 out of 95 security vendors marking it as a phishing threat. Additionally, the domain employs a Let's Encrypt SSL certificate, which, while providing encryption, is commonly abused by threat actors to lend a false sense of legitimacy to phishing sites. Users who have visited of-whatapp.top or entered credentials on the site should take immediate action to mitigate potential risks. First, any credentials entered on the site should be considered compromised and changed immediately across all platforms where the same credentials may have been reused. Affected users are advised to enable multi-factor authentication on their accounts to prevent unauthorized access. Additionally, monitoring for unusual activity, such as unauthorized messages or login attempts, is recommended. Organizations and individuals should block the domain and its associated IP address (154.206.233.25) at the network level to prevent further exposure. Reporting the domain to relevant security teams or threat intelligence platforms can aid in broader mitigation efforts.