web-zh-whatsappweb[.]com[.]cn

This domain, web-zh-whatsappweb.com.cn, was registered on February 21, 2026 and is currently taken offline. The site presented the page title “WhatsApp 网页版” and was identified as a social‑media phishing campaign that impersonates Facebook. Reputation services assign it a Scamadviser trust score of 1/100 and a Gridinsoft score of 0/100, indicating extreme lack of credibility. VirusTotal recorded 16 detections out of 95 scanned security vendors, confirming that multiple engines flag the domain as malicious. AlienVault OTX references the domain in 14 separate threat‑intel pulses, demonstrating that the indicator has been shared broadly across the community.

The domain appears on one public security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as hostile infrastructure. DNS resolution points to IP address 45.200.20.6, which belongs to AS139646 Hong Kong Lightlayer Technology Co., Limited and is geolocated in Hong Kong. The SSL certificate is labeled “R12”, a low‑grade or possibly self‑signed certificate that provides little assurance of authenticity. The combination of a brand‑impersonation page title, low trust scores, multiple vendor detections, and shared OTX references suggests a coordinated attempt to harvest Facebook credentials through a counterfeit WhatsApp‑styled login portal.

Uncertainty remains around the exact phishing kit used and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the same IP range, because the available intelligence does not disclose further hosting details or payload analysis. Defenders should continue to block the domain at perimeter filters, add the IP address to network‑level deny lists, and monitor for any resurgence of the host or similar domain registrations that reuse the “web‑zh‑whatsappweb” naming pattern. Regularly updating URL‑filtering feeds with the latest OTX pulses and checking for new VirusTotal scans will help maintain visibility.