whatsekg[.]cc

The domain whatsekg.cc was registered through Dominet (HK) Limited on October 11 2025. DNS resolution points exclusively to the address 103.99.210.25, which is announced by AS205960 under HDTIDC LIMITED and geolocated to the Republic of Korea. No TLS certificate is presented, indicating the site operates over plaintext HTTP. The authoritative name servers listed are ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com and ns4.domainname. The page title observed during analysis reads "whatsapp在線登錄電腦 - - 夜間模式設置：保護眡力的實用功能", confirming a targeted impersonation of the WhatsApp brand.

The threat is classified as brand impersonation, specifically targeting WhatsApp users. Security telemetry shows the domain appears on a single blocklist and has been flagged by PhishDestroy. On VirusTotal, 15 of 95 scanning engines returned a positive verdict, reflecting moderate detection confidence. AlienVault OTX records the domain in sixteen separate threat pulses, reinforcing its malicious reputation. Gridinsoft assigned a trust score of 0 / 100, and the overall risk rating is elevated.

As of the reporting date (July 23 2026) the domain is listed as offline, suggesting the hosting has been taken down or the site is otherwise inaccessible. Defenders should continue to block the domain and its associated IP, monitor any future DNS changes, and consider adding the name servers to deny‑list rules. Additional monitoring of HDTIDC‑owned infrastructure in South Korea is advisable, as similar abuse may be launched from the same autonomous system. Continuous review of emerging OTX pulses and VirusTotal updates will help maintain situational awareness.