web[.]whatsapp[.]jo[.]hl[.]cn

This domain, web.whatsapp.jo.hl.cn, is flagged as a generic phishing site specifically designed to impersonate WhatsApp Web. Analysis indicates the infrastructure was established to harvest user credentials, session tokens, or other sensitive information by mimicking the legitimate WhatsApp Web interface. The page title, 'WhatsApp Web,' further confirms the intent to deceive users into believing they are interacting with the official WhatsApp service. No evidence of a drainer kit or cryptocurrency wallet interaction was identified in this instance, focusing instead on traditional credential theft. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 168.76.144.218, hosted under AS137951 (ASLINE LIMITED) in Hong Kong. It was registered through 成都垦派科技有限公司 on February 28, 2026, an unusually future-dated registration likely intended to evade immediate detection. The domain appears on one security blocklist and is flagged by 24 out of 95 security vendors on VirusTotal, indicating a moderate to high level of detection. The SSL certificate, issued by Let's Encrypt (R12), provides basic encryption but does not validate the legitimacy of the site. No Google Safe Browsing (GSB) listing was observed at the time of analysis, though this may change as the domain ages. Currently, web.whatsapp.jo.hl.cn is offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for similar phishing campaigns. Users who may have interacted with this domain should immediately revoke any active sessions, reset passwords, and enable multi-factor authentication on their accounts. Organizations are advised to block the domain and associated IP address (168.76.144.218) at the network level to prevent potential re-emergence. Despite its offline status, the domain's registration details and hosting provider suggest a persistent threat, warranting continued monitoring.