vi-whatapp[.]hl[.]cn

The domain vi-whatapp.hl.cn is currently active and classified as a high-risk generic phishing threat. Analysis indicates this site impersonates WhatsApp Web, a legitimate messaging platform, to deceive users into entering login credentials or personal information. The page title, 'WhatsApp网页版 - 完整指南与使用方法,' directly targets Chinese-speaking users by mimicking official WhatsApp Web documentation, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered through 万商云集（成都）科技股份有限公司 on June 28, 2026, an unusually future-dated creation that may indicate an attempt to evade initial scrutiny. It resolves to the IP address 154.206.233.26 and employs a Let's Encrypt SSL certificate, which, while providing encryption, is commonly abused by threat actors to lend a false sense of legitimacy. As of the latest assessment, 16 out of 95 security vendors on VirusTotal have flagged this domain as malicious, with detections including phishing, fraud, and credential theft. The domain remains unblocked by major browser-based protections, allowing it to persist in active campaigns. Current status confirms the domain is still operational and poses a significant risk to users. The combination of brand impersonation, SSL abuse, and low initial detection rates suggests a targeted or evolving threat. Users are strongly advised to avoid interacting with this domain and to verify the authenticity of any WhatsApp Web login page by ensuring it originates from the official whatsapp.com domain. Organizations should consider blocking the IP address 154.206.233.26 and the domain vi-whatapp.hl.cn at the network level, while monitoring for credential reuse or unauthorized access attempts stemming from this campaign. Security teams are encouraged to treat this domain as a high-priority indicator of compromise and investigate any prior exposure within their environments.