First impression for most users would be that this is credential harvesting webpage with who knows what running behind it.
Have you played with the node.js clients?
Using my own phone and account BTW.
Worked for my android. Still not working for iOS.
I was using \test\whatsapp.php.
1) Your mac address is available to even passive sniffers without the key to an encrypted network. In some circumstances you don't even need to be connected to a network to grab someone's mac address (iPhones in particular love looking for networks loudly).
2) FTP and AIM passwords can be changed. Yes, a passive sniffer on the same network can still get them, but this is a significantly harder task than getting someone's mac address, and there's no way to change the goal.
3) Brute force attacks become within the realm of possibility. Have someone you know has an iPhone 5 and uses WhatsApp? The first chunk of the mac address is assigned by vendor, so you've already narrowed the search space down drastically by half to needing to guess 6 hex digits.
How about if you're on someone else's network (work, a friend's, an airport, etc...)
There is definitely a place to out a company that fails to secure things consistently, but asking for credentials in this way absolutely wrecks your credibility to anyone but the most trusting of people that already knows you. No one should input anything into this form, even if it's credible. To do so, is assuming that it is not being stored in any way (unprovable), and that it is following security best practices (on a site that's not even operating on a secure connection). I'm sure you are a standup guy, but I hope we never get complacent with blindly accepting "hack checkers" like the ones that popped up around other notable hacks recently