web[.]whatsapp[.]gv[.]hl[.]cn

This domain is flagged as a generic phishing threat with an elevated risk level. Analysis indicates it specifically impersonates WhatsApp Web to harvest user credentials through a fraudulent login interface, a common tactic in credential theft campaigns. Infrastructure analysis reveals the domain was registered on February 28, 2026, through 成都垦派科技有限公司, a registrar frequently associated with phishing operations. It resolves to IP address 172.104.99.107 and is currently offline. The site was detected by 23 out of 95 security vendors on VirusTotal and appears on one security blocklist. Technical indicators include the use of Let's Encrypt SSL certificates, Cloudflare hosting, Nginx web server, and front-end frameworks such as Tailwind CSS, Bootstrap, Lodash, and jQuery. The page title explicitly mimics WhatsApp Web, reinforcing its deceptive purpose. Users and administrators should treat this domain as malicious. Immediate mitigation steps include blocking the domain and its associated IP (172.104.99.107) at network perimeter devices. Endpoints should be scanned for exposure to the domain, particularly in browser history or email links. Security teams should review logs for connections to the IP or domain to identify compromised accounts. Credential resets are recommended for any users who accessed the site. Monitoring for similar domains using the same registrar or hosting patterns is advised to preempt further phishing attempts.