When you visit arrive-whatapp.hl.cn, you don't get a real website. Instead, it immediately sends you to hk.yahoo.com. That's a huge red flag. Legitimate businesses don't build a one-day-old domain just to redirect somewhere else. The domain name itself is a clear attempt to trick people into thinking it's related to WhatsApp, but the spelling is off by one letter. This is a common phishing tactic. The site also hides behind a private WHOIS record and has no contact information, no privacy policy, and no track record on the web. Given the extreme youth of the domain and the immediate redirect, there is no reason to trust arrive-whatapp.hl.cn. If you landed here by accident, close the tab and don't look back. If you were expecting to find WhatsApp's official site, double-check the URL and use only the real domain: whatsapp.com.
No — arrive-whatapp.hl.cn doesn't look safe
In plain English
This site is dangerous and almost certainly a scam. It was created just one day ago, has no visible content, and immediately redirects to another website. The domain name is a deliberate misspelling of WhatsApp, which is a common trick to catch people off guard. Do not share any personal information or click anything on this domain.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The site has a valid certificate and basic protections like HSTS and CSP enabled, which is standard. But it also accepts outdated TLS versions, which is a minor weakness.
The domain is barely one day old and registered with a personal email address. The name itself mimics WhatsApp with a typo, which is a classic sign of impersonation.
The domain hasn't been flagged by any blacklist yet, but it has zero history on the web and no established presence. One day is not enough time to build any real reputation.
There is no visible contact information, no about page, and the site immediately redirects to a completely different domain. The people behind this site are not showing themselves.
No legal pages like a privacy policy or terms of service are present. For a site that likely aims to trick users, this absence is expected but still a major gap.
DNS is configured and the site resolves, but DNSSEC is missing and there are no email servers set up. The hosting provider is small and the nameservers are from an obscure domain.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.