wechath5-nonprod[.]westernunion[.]cloud

This domain poses an elevated risk because it impersonates Western Union in a generic phishing campaign. The site was taken offline, but while active it aimed to steal login credentials or personal information from unsuspecting users. PhishDestroy assesses this as a significant threat due to the brand impersonation and the high number of security vendor flags.

Technical indicators are alarming: VirusTotal detected 12 out of 95 security vendors flagging this domain as malicious. The domain was registered through DNSPod, Inc. and resolves to IP address 184.86.103.152. It was created on February 21, 2026, and appears on one security blocklist. The SSL certificate was issued by DNSPod, Inc., specifically a DNSPod DV TLS RSA CA 2025 certificate, which lends a false sense of legitimacy. The page title was simply "Western Union," a clear attempt to deceive visitors.

To stay safe, users should never enter personal or financial information on sites accessed via unsolicited links or emails. Always verify the URL before logging in, and report any suspicious Western Union-related domains to the company. PhishDestroy recommends enabling multi-factor authentication on all accounts and using a reputable security solution that can block known phishing domains. If you have already interacted with this site, change your passwords immediately and monitor your accounts for fraudulent activity.