whatsewq[.]cc

The domain whatsewq.cc was created on October 11, 2025 and is currently listed as offline. It is registered through Dominet (HK) Limited and uses four authoritative name servers (ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, ns4.domainname). The host resolves to the IPv4 address 103.99.210.26, which belongs to AS205960 operated by HDTIDC LIMITED and is geolocated in South Korea. No TLS certificate is presented for the site, indicating that any traffic would be transmitted over plain HTTP.

The page title observed during the brief crawl reads "whatsapp網頁登錄入口 - - 與桌麪版的區別：選擇最佳使用方式," directly referencing the WhatsApp brand and suggesting a login portal. VirusTotal records show that 15 of 95 scanned security vendors flagged the domain as malicious, reflecting a moderate detection consensus. AlienVault OTX has associated the domain with 16 separate threat‑intel pulses, and it appears on a single external blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns it a trust score of 0 out of 100.

The available evidence points to a classic brand‑impersonation campaign targeting WhatsApp users, likely intended to harvest credentials. Uncertainty remains regarding the specific phishing kit used, the extent of victim exposure, and any command‑and‑control infrastructure beyond the observed IP. Defenders should continue to block the domain at DNS and web‑filter layers, monitor for related C2 traffic to 103.99.210.26, and incorporate the observed page title and name‑server pattern into detection rules. Ongoing intelligence gathering is advised to capture any future re‑hosting attempts or associated payloads.