WhatsApp

Messaging United Stateswhatsapp.comRank 7 of the most impersonated
Cert findings · 24 h
5
Cert findings · 7 days
65
21 reported or listed · 35 on phishing hosts · 9 on Spamhaus DROP
Registered lookalikes
365
23 listed by a source or an address list
Official domains
9
verified from WhatsApp's own sites and records

Certificate findings for WhatsApp

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to WhatsApp's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 80 findings, grouped by hostname

  1. wswsweb-whatsapp.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 23 d ago
    DetailsHide
    Hostname
    wswsweb-whatsapp.com
    First seen
    2026-11-05 01:41 UTC
    First published
    2026-11-05 01:50 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-05 00:00 UTC to 2027-01-28 20:44 UTC
    Logged 2026-11-05 01:37 UTC in Let's Encrypt Sycamore2027h1, entry 951,027,739
    SHA-256 4598274f3248ceca6cd37b807b3db669d0ed1cfb1d1e0931b2a1c5e771388b69
    Public key SHA-256 41a9f43647eaa6e6a01ae8c458b97273adebcaa3ad6cbbad4af9817c92c04091
    PhishDestroy
    Brand
    WhatsApp
    Addresses
    104.21.26.236 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.168.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:1aec
    2606:4700:3032::ac43:a898
    Cloudflare
    Cloudflare (104.21.26.236, 172.67.168.152): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wswsweb-whatsapp.com
    Registered
    2026-10-13 · EU Technology (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  2. we-mk-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mk-whatsapp.com
    First seen
    2026-11-04 16:51 UTC
    First published
    2026-11-04 18:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving · checked 2026-11-04 18:17 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 15:47 UTC to 2027-02-02 15:47 UTC
    Logged 2026-11-04 16:46 UTC in IPng Networks Gouda2027h1, entry 316,292,295
    SHA-256 0f93c82104c4a3805f0ac52945d3d672518105881d855fd362ae581870b834f3
    Public key SHA-256 b20ae64e037667eaca8dfabb8792ea2d65237a908e0105a97493f677c9bcb9ae
    Brand
    WhatsApp
    Domain
    we-mk-whatsapp.com
    Registered
    2026-05-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:07 UTC

    Suggest a correction

  3. oucc.uoabse-whatsapp.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    oucc.uoabse-whatsapp.com
    First seen
    2026-11-04 15:03 UTC
    First published
    2026-10-30 14:56 UTC
    DNS
    Resolves · checked 2026-11-04 15:03 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Resolved to 206.161.218.138
    Brand
    WhatsApp
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    163.5.85.50 · Netherlands · AS218253 Airnode Ivo de Witte trading as Airnode Hosting
    Domain
    uoabse-whatsapp.com
    Registered
    2026-10-30 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  4. we-mg-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mg-whatsapp.com
    First seen
    2026-11-04 13:36 UTC
    First published
    2026-11-04 13:59 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving · checked 2026-11-04 14:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 12:34 UTC to 2027-02-02 12:34 UTC
    Logged 2026-11-04 13:32 UTC in Let's Encrypt Sycamore2027h1, entry 941,744,199
    SHA-256 62cf14b87d3a685a9af24cd881c3c87e6afbd6028d04955a1eafa4a9a3fb8915
    Public key SHA-256 9ba166765ba2e8526d29b6514845ca68773e652eac307ff4981d8317cf5cf32f
    Brand
    WhatsApp
    Domain
    we-mg-whatsapp.com
    Registered
    2026-05-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:59 UTC

    Suggest a correction

  5. whatsapp-no-api.service-bonsai.com US · AS400940 · Railway
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 21 mo ago
    DetailsHide
    Hostname
    whatsapp-no-api.service-bonsai.com
    First seen
    2026-11-04 11:43 UTC
    First published
    2026-11-04 11:54 UTC
    DNS
    Resolves · checked 2026-11-04 12:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.46.46.54.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 69.46.46.54
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 10:38 UTC to 2027-02-02 10:38 UTC
    Logged 2026-11-04 11:37 UTC in Google ParcelYard2027h1, entry 607,646,823
    SHA-256 171d46288102f769180f8c02bd02be82114efbbd7236a56a590dbe71572a7c55
    Public key SHA-256 7c2ef581748bc92e9e82d31dfc08a712e42ea60545670a54f30ece49e8bfe446
    Brand
    WhatsApp
    Addresses
    69.46.46.54 · United States · AS400940 RAILWAY - Railway
    Domain
    service-bonsai.com
    Registered
    2025-02-27 · IONOS SE
    MX
    Receives mail at mx00.ionos.es, mx01.ionos.es
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:54 UTC

    Suggest a correction

  6. we-mh-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mh-whatsapp.com
    First seen
    2026-11-04 09:36 UTC
    First published
    2026-11-04 10:38 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 10:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 08:36 UTC to 2027-02-02 08:36 UTC
    Logged 2026-11-04 09:35 UTC in Google PlumbersArms2027h1, entry 606,427,110
    SHA-256 2793f3f53f316b4aaa29c9867871efabd676cea7c49e4c4a90a79aa3812bd745
    Public key SHA-256 da54022a3ab53deb8cd74bc909d49b0ff9b7cc2a4686e9d647d2c35cb2536328
    Brand
    WhatsApp
    Domain
    we-mh-whatsapp.com
    Registered
    2026-05-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:42 UTC

    Suggest a correction

  7. www.whsn-whatsapp.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…3 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 d ago
    DetailsHide
    Hostname
    www.whsn-whatsapp.com
    First seen
    2026-11-04 09:32 UTC
    First published
    2026-11-02 09:27 UTC
    DNS
    Resolves · checked 2026-11-05 09:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 103.27.178.154.
    1. Phishing-host list fetched with the address
    2. Resolved to 103.27.178.154
    3. Latest DNS check
    Brand
    WhatsApp
    Addresses
    103.27.178.154 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    103.27.178.155 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    103.27.178.156 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    whsn-whatsapp.com
    Registered
    2026-11-02 · Key-Systems GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  8. we-ml-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-ml-whatsapp.com
    First seen
    2026-11-04 09:05 UTC
    First published
    2026-11-04 09:19 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 09:38 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 08:02 UTC to 2027-02-02 08:02 UTC
    Logged 2026-11-04 09:00 UTC in Let's Encrypt Willow2027h1, entry 929,448,105
    SHA-256 36e5e7f7e5756f95bcaeca4befa46266586dfebdce2289c3e64563adb4e0e0f4
    Public key SHA-256 0eff99d0fe91d6a926a4919318890c1fb3ee3cd677641e6b2a15a2d68dc35da1
    Brand
    WhatsApp
    Domain
    we-ml-whatsapp.com
    Registered
    2026-05-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:10 UTC

    Suggest a correction

  9. co-vvhatsapp.cc HK · AS135357 · HONG KONG KOWLOON TELECOMMU…Lookalike of whatsapp.com · similar-looking characters
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    co-vvhatsapp.cc
    First seen
    2026-11-04 08:58 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Resolved to 206.161.218.138
    3. Latest DNS check
    Brand
    WhatsApp (spelled like whatsapp.com with similar-looking characters)
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    co-vvhatsapp.cc
    Registered
    2026-10-26 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  10. we-mq-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mq-whatsapp.com
    First seen
    2026-11-04 07:36 UTC
    First published
    2026-11-04 08:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 08:17 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 06:33 UTC to 2027-02-02 06:33 UTC
    Logged 2026-11-04 07:32 UTC in Let's Encrypt Willow2027h1, entry 928,289,031
    SHA-256 0f79bc85ce171aa97d8ec7b9c45b64d81f306d6c0dbcf2e13bf71066677df743
    Public key SHA-256 b477b3543d663bff9a3a075bfc8830a004dbafe5243ee472e43180bb7980997f
    Brand
    WhatsApp
    Domain
    we-mq-whatsapp.com
    Registered
    2026-05-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:36 UTC

    Suggest a correction

  11. we-mf-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mf-whatsapp.com
    First seen
    2026-11-04 07:10 UTC
    First published
    2026-11-04 08:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 08:17 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 06:11 UTC to 2027-02-02 06:11 UTC
    Logged 2026-11-04 07:09 UTC in IPng Networks Gouda2027h1, entry 311,638,481
    SHA-256 a1718b343e0076873472a7de0a2c989be9b09ad323fdc23e0f4d8e278139d52b
    Public key SHA-256 0791a33b052239ee78c211789074a2b9d0babd1fbd701c3140d8c8ba2dbe3aed
    Brand
    WhatsApp
    Domain
    we-mf-whatsapp.com
    Registered
    2026-05-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:36 UTC

    Suggest a correction

  12. we-md-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-md-whatsapp.com
    First seen
    2026-11-04 06:00 UTC
    First published
    2026-11-04 06:49 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 07:06 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 04:57 UTC to 2027-02-02 04:57 UTC
    Logged 2026-11-04 05:55 UTC in Let's Encrypt Sycamore2027h1, entry 935,639,443
    SHA-256 99a72bde3b8c3a1959304407f811822aaaf0ac2c0954a32465cab13a528dc572
    Public key SHA-256 96d171de81b1038c3962f1cc558fe83fd820e8b4da917db2e7ba84ebd30a6630
    Brand
    WhatsApp
    Domain
    we-md-whatsapp.com
    Registered
    2026-05-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:06 UTC

    Suggest a correction

  13. we-mj-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mj-whatsapp.com
    First seen
    2026-11-04 03:26 UTC
    First published
    2026-11-04 04:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 04:28 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 02:24 UTC to 2027-02-02 02:24 UTC
    Logged 2026-11-04 03:23 UTC in IPng Networks Gouda2027h1, entry 309,802,389
    SHA-256 6db46f232acace7526dc18ec40683b2069cee02066ef040f8187de6f11ee7b5f
    Public key SHA-256 0b7b7290ffd02ba01b47385dfa53eff0108376cd2e41966e7d68ff451041fc3b
    Brand
    WhatsApp
    Domain
    we-mj-whatsapp.com
    Registered
    2026-05-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:33 UTC

    Suggest a correction

  14. we-mv-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mv-whatsapp.com
    First seen
    2026-11-03 11:46 UTC
    First published
    2026-11-03 12:13 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-04 12:24 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 10:42 UTC to 2027-02-01 10:42 UTC
    Logged 2026-11-03 11:41 UTC in Google PlumbersArms2027h1, entry 589,891,688
    SHA-256 5e2a7ead8998e8fb2a8c015d2ec83217aa08024ee227398d20f8b1fe023d3b19
    Public key SHA-256 9b01785e34848005f2bc5dc247bfdd32cc2de54a70855fca6bb4abefbb1cb1a5
    Brand
    WhatsApp
    Domain
    we-mv-whatsapp.com
    Registered
    2026-05-10 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 12:16 UTC

    Suggest a correction

  15. we-mb-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mb-whatsapp.com
    First seen
    2026-11-03 11:41 UTC
    First published
    2026-11-03 12:13 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-04 12:24 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 10:41 UTC to 2027-02-01 10:41 UTC
    Logged 2026-11-03 11:39 UTC in Google ParcelYard2027h1, entry 589,408,430
    SHA-256 04675d6a05ae8c3bbd058593e4ed6074d4ffc6610dedb959115b9e044189ab97
    Public key SHA-256 bee385a12c4e0bc788f5d1d32b2401dde7ea3d9a231310fcd32e661878cb2d1f
    Brand
    WhatsApp
    Domain
    we-mb-whatsapp.com
    Registered
    2026-05-10 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 12:16 UTC

    Suggest a correction

  16. we-mm-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mm-whatsapp.com
    First seen
    2026-11-03 09:14 UTC
    First published
    2026-11-03 09:58 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-05 10:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 08:12 UTC to 2027-02-01 08:12 UTC
    Logged 2026-11-03 09:10 UTC in Let's Encrypt Sycamore2027h1, entry 918,740,105
    SHA-256 3a242ed3b1e7e3f7fcd0e2cd41b3298e9f6e9b9fc234d6fd50f63f6c117e656f
    Public key SHA-256 4172495403c63610207e69702c31e8d99bae4c2b62f0bc4dac4149ae8fb2a454
    Brand
    WhatsApp
    Domain
    we-mm-whatsapp.com
    Registered
    2026-05-10 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:59 UTC

    Suggest a correction

  17. woshuo-whatsapp.hk.cn US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    woshuo-whatsapp.hk.cn
    First seen
    2026-11-03 08:20 UTC
    First published
    2026-11-03 08:50 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 07:16 UTC to 2027-02-01 07:16 UTC
    Logged 2026-11-03 08:15 UTC in Let's Encrypt Sycamore2027h1, entry 917,914,096
    SHA-256 69a2350d5283575484ddd2daaf341e1486cde14ad1980aab93ff5004f21749e8
    Public key SHA-256 5f1339e71def728ec2b1b08cff4f6ceb2a224e259ae7455122fb27d8ab8c3765
    PhishDestroy
    Brand
    WhatsApp
    Addresses
    104.21.36.176 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.197.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:c5ed
    2606:4700:3032::6815:24b0
    Cloudflare
    Cloudflare (104.21.36.176, 172.67.197.237): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    woshuo-whatsapp.hk.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  18. we-mn-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mn-whatsapp.com
    First seen
    2026-11-03 07:41 UTC
    First published
    2026-11-03 08:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 06:38 UTC to 2027-02-01 06:38 UTC
    Logged 2026-11-03 07:36 UTC in Google PlumbersArms2027h1, entry 586,496,039
    SHA-256 0f385e68d5680c7c19e06833bb5110740588a72a5fbe23688c4f1e886b3d3406
    Public key SHA-256 b6f1fe69496b4c606ca395413cd725ee2e8102b361a308a0586734140db906be
    Brand
    WhatsApp
    Domain
    we-mn-whatsapp.com
    Registered
    2026-05-10 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  19. we-mz-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mz-whatsapp.com
    First seen
    2026-11-03 06:36 UTC
    First published
    2026-11-03 07:43 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-05 07:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 05:33 UTC to 2027-02-01 05:33 UTC
    Logged 2026-11-03 06:32 UTC in IPng Networks Halloumi2027h1, entry 345,269,310
    SHA-256 03ddd94db0d0f697a826e98a8612e0b8290699ce38efa5eec0682518d8113f9b
    Public key SHA-256 d74c1605f8c1cf7e9587c68d5de4f807fc326fc074e6aa082cf8fe802026229f
    Brand
    WhatsApp
    Domain
    we-mz-whatsapp.com
    Registered
    2026-05-10 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  20. we-mc-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mc-whatsapp.com
    First seen
    2026-11-03 06:31 UTC
    First published
    2026-11-03 07:43 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-05 07:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 05:28 UTC to 2027-02-01 05:28 UTC
    Logged 2026-11-03 06:27 UTC in Google ParcelYard2027h1, entry 585,172,127
    SHA-256 24641997492c9dbf26bbc869dc8cd82fda104b610ff2bdc6bf1cbd899b9353cb
    Public key SHA-256 717dc4514cac492c42cc9291df96d737696dc2bee9781998db43af3433148f85
    Brand
    WhatsApp
    Domain
    we-mc-whatsapp.com
    Registered
    2026-05-10 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  21. www.xbii-whatsapp.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    www.xbii-whatsapp.com
    First seen
    2026-11-03 06:27 UTC
    First published
    2026-11-03 06:36 UTC
    DNS
    Resolves · checked 2026-11-05 06:39 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 103.27.178.154.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.27.178.154
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-03 05:26 UTC to 2027-02-01 05:26 UTC
    Logged 2026-11-03 06:24 UTC in Let's Encrypt Sycamore2027h1, entry 916,490,846
    SHA-256 302168e429d6e8db4dbcf6bd327862d5cfb82783358f800ec15b87536bae6580
    Public key SHA-256 6afd17aa0bd85fda8a3a6c5eeab447a74fa2125ba93a24f77907297ec284792e
    Brand
    WhatsApp
    Addresses
    103.27.178.154 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    xbii-whatsapp.com
    Registered
    2026-11-03 · Key-Systems GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:38 UTC

    Suggest a correction

  22. we-mx-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    we-mx-whatsapp.com
    First seen
    2026-11-03 04:16 UTC
    First published
    2026-11-03 04:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-05 05:06 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 03:16 UTC to 2027-02-01 03:16 UTC
    Logged 2026-11-03 04:14 UTC in DigiCert Sphinx2027h1, entry 338,695,246
    SHA-256 7f84b48c9607dc591152e81428eeadd2cf5a7accd81ad10adba009dc2601973c
    Public key SHA-256 ce86382048c879cbab9abf3e56a39705340f912dc86040c67f4929551e2cdb5b
    Brand
    WhatsApp
    Domain
    we-mx-whatsapp.com
    Registered
    2026-05-10 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:03 UTC

    Suggest a correction

  23. www.ios-whatsapp.icu MD · AS200019 · AlexHost ALEXHOST S.R.L.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    www.ios-whatsapp.icu
    First seen
    2026-11-02 19:58 UTC
    First published
    2026-10-30 05:30 UTC
    DNS
    Resolves · checked 2026-11-05 05:39 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.199.133.247.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.199.133.247
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 18:54 UTC to 2027-01-31 18:54 UTC
    Logged 2026-11-02 19:53 UTC in IPng Networks Halloumi2027h1, entry 341,159,730
    SHA-256 63ba551899924d59f424184d9b1d030619907056a10ad47015ecc96433585534
    Public key SHA-256 d4ccb611a30c94e29723ed60dea1697e351e79ed251efd1384625600d9e444a9
    Brand
    WhatsApp
    Addresses
    91.199.133.247 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    85.121.4.201 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    ios-whatsapp.icu
    Registered
    2026-04-01 · Gname.com Pte. Ltd.
    MX
    Receives mail at mx.ios-whatsapp.icu
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  24. ios-whatsapp.icu MD · AS200019 · AlexHost ALEXHOST S.R.L.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    ios-whatsapp.icu
    First seen
    2026-11-02 19:58 UTC
    First published
    2026-10-30 05:30 UTC
    DNS
    Resolves · checked 2026-11-05 05:39 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.199.133.247.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.199.133.247
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 18:54 UTC to 2027-01-31 18:54 UTC
    Logged 2026-11-02 19:53 UTC in IPng Networks Halloumi2027h1, entry 341,159,730
    SHA-256 63ba551899924d59f424184d9b1d030619907056a10ad47015ecc96433585534
    Public key SHA-256 d4ccb611a30c94e29723ed60dea1697e351e79ed251efd1384625600d9e444a9
    Brand
    WhatsApp
    Addresses
    91.199.133.247 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    85.121.4.201 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    ios-whatsapp.icu
    Registered
    2026-04-01 · Gname.com Pte. Ltd.
    MX
    Receives mail at mx.ios-whatsapp.icu
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  25. whatsapp.wooflers.com US · AS26496 · GoDaddy.com, LLC
    ReportedGoDaddyReported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 10 y ago
    DetailsHide
    Hostname
    whatsapp.wooflers.com
    First seen
    2026-11-02 19:21 UTC
    First published
    2026-11-02 20:24 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:29 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-02 18:19 UTC to 2027-01-31 18:19 UTC
    Logged 2026-11-02 19:17 UTC in Google ParcelYard2027h1, entry 577,118,371
    SHA-256 11937fb6de62a28a7c2a6c94611f8db58b4e4467864e00a82745159ba965c647
    Public key SHA-256 d98127e5ca4273309da17a1ad7d13eed796315e600580a2e686d776b69d89694
    PhishDestroy
    Brand
    WhatsApp
    Addresses
    68.178.238.223 · United States · AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC · GoDaddy (shared hosting)
    GoDaddy
    GoDaddy (68.178.238.223): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    wooflers.com
    Registered
    2016-07-30 · GoDaddy.com, LLC
    MX
    Receives mail at mail.wooflers.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  26. www.mywhatsapp.work RU · AS9123 · TimeWeb-AS JSC "TIMEWEB"
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    www.mywhatsapp.work
    First seen
    2026-11-02 17:06 UTC
    First published
    2026-11-02 18:02 UTC
    DNS
    Resolves · checked 2026-11-04 18:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 92.53.96.169.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 92.53.96.169
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-02 16:06 UTC to 2027-01-31 16:06 UTC
    Logged 2026-11-02 17:04 UTC in Google ParcelYard2027h1, entry 575,516,723
    SHA-256 19b5e6e144bd93f7a59d2578249d88dbfb6b5663a41f12df6eefa470afbac4f4
    Public key SHA-256 a8ae99f7a41ff97d74ecdd67056e0fa5a2723bf3d7ec11422da439bb12b5430d
    Brand
    WhatsApp
    Addresses
    92.53.96.169 · Russia · AS9123 TimeWeb-AS JSC "TIMEWEB"
    Domain
    mywhatsapp.work
    Registered
    2026-07-06 · GoDaddy.com, LLC
    MX
    Receives mail at mx1.timeweb.ru, mx2.timeweb.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  27. mywhatsapp.work RU · AS9123 · TimeWeb-AS JSC "TIMEWEB"
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    mywhatsapp.work
    First seen
    2026-11-02 17:06 UTC
    First published
    2026-11-02 18:02 UTC
    DNS
    Resolves · checked 2026-11-04 18:09 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 92.53.96.169.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 92.53.96.169
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-02 16:06 UTC to 2027-01-31 16:06 UTC
    Logged 2026-11-02 17:04 UTC in Google ParcelYard2027h1, entry 575,516,723
    SHA-256 19b5e6e144bd93f7a59d2578249d88dbfb6b5663a41f12df6eefa470afbac4f4
    Public key SHA-256 a8ae99f7a41ff97d74ecdd67056e0fa5a2723bf3d7ec11422da439bb12b5430d
    Brand
    WhatsApp
    Addresses
    92.53.96.169 · Russia · AS9123 TimeWeb-AS JSC "TIMEWEB"
    Domain
    mywhatsapp.work
    Registered
    2026-07-06 · GoDaddy.com, LLC
    MX
    Receives mail at mx1.timeweb.ru, mx2.timeweb.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  28. boostboost-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 15 d ago
    DetailsHide
    Hostname
    boostboost-whatsapp.com
    First seen
    2026-11-02 09:15 UTC
    First published
    2026-11-02 09:27 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-02 · checked 2026-11-05 09:33 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-02 00:00 UTC to 2027-01-22 21:54 UTC
    Logged 2026-11-02 09:12 UTC in Let's Encrypt Sycamore2027h1, entry 900,809,960
    SHA-256 39e1be73b8d537f68f31868516f804a1845f9e8317e29ab55e8fd098d03b58f2
    Public key SHA-256 e43f6f842063c60a08e7ffc64b49ca94d1557196db07b7d09d6141c4cf7457bd
    Brand
    WhatsApp
    Domain
    boostboost-whatsapp.com
    Registered
    2026-10-21 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  29. whatsapp-ehbi.ltd US · AS21859 · Zenlayer Inc2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    whatsapp-ehbi.ltd
    First seen
    2026-11-01 21:37 UTC
    First published
    2026-11-01 22:48 UTC
    DNS
    Resolves · checked 2026-11-04 22:56 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 128.14.74.107.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 128.14.74.107
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-01 00:00 UTC to 2027-01-16 13:40 UTC
    Logged 2026-11-01 21:34 UTC in Geomys Tuscolo2027h1, entry 437,069,327
    SHA-256 013841e78735a17e6155f60a9afe2601b0ccfad4f8b93cc44882b915ddf2ac9a
    Public key SHA-256 eb58ad9d68cb19af1439ede6645cf80bf05e29acc3eed5d351cb969837710917
    Brand
    WhatsApp
    Addresses
    128.14.74.107 · United States · AS21859 ZEN-ECN - Zenlayer Inc
    128.14.74.124 · United States · AS21859 ZEN-ECN - Zenlayer Inc
    Domain
    whatsapp-ehbi.ltd
    Registered
    2025-11-01 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  30. whats-app-g.net GB · AS214351 · FEMOIT FEMO IT SOLUTIONS LI…
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 4 d ago
    DetailsHide
    Hostname
    whats-app-g.net
    First seen
    2026-11-01 20:47 UTC
    First published
    2026-11-01 21:34 UTC
    DNS
    Resolves · checked 2026-11-04 21:47 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 196.251.122.86.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 196.251.122.86
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-01 19:46 UTC to 2027-01-30 19:46 UTC
    Logged 2026-11-01 20:45 UTC in Let's Encrypt Sycamore2027h1, entry 892,376,036
    SHA-256 22c4c5065d906ab165fa449436982d80e791191cca3382dbc3f804911532e74d
    Public key SHA-256 4caf2c7295131ed90b1f45e3af904520d40234cbe698878a4f1fdc8eead2fed2
    Brand
    WhatsApp
    Addresses
    196.251.122.86 · United Kingdom · AS214351 FEMOIT FEMO IT SOLUTIONS LIMITED
    Domain
    whats-app-g.net
    Registered
    2026-11-01 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  31. www.i-whatsapp.cyou MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    www.i-whatsapp.cyou
    First seen
    2026-11-01 18:53 UTC
    First published
    2026-11-01 19:10 UTC
    DNS
    Resolves · checked 2026-11-04 19:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.199.133.247.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.199.133.247
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-01 17:47 UTC to 2027-01-30 17:47 UTC
    Logged 2026-11-01 18:46 UTC in IPng Networks Gouda2027h1, entry 287,653,367
    SHA-256 1ddcc044d3c719d5ce541aaaf777f587e610de4b930a36ef52340ec82cf79c36
    Public key SHA-256 bd55a5c77da9372c354f0df84b276b9d2a2a7c0e5698a5de6d5d56aae7754dfa
    Brand
    WhatsApp
    Addresses
    91.199.133.247 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    i-whatsapp.cyou
    Registered
    2026-03-28 · Gname.com Pte. Ltd.
    MX
    Receives mail at mx.i-whatsapp.cyou
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  32. i-whatsapp.cyou MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    i-whatsapp.cyou
    First seen
    2026-11-01 18:52 UTC
    First published
    2026-11-01 19:10 UTC
    DNS
    Resolves · checked 2026-11-04 19:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.199.133.247.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.199.133.247
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-01 17:47 UTC to 2027-01-30 17:47 UTC
    Logged 2026-11-01 18:46 UTC in IPng Networks Gouda2027h1, entry 287,653,367
    SHA-256 1ddcc044d3c719d5ce541aaaf777f587e610de4b930a36ef52340ec82cf79c36
    Public key SHA-256 bd55a5c77da9372c354f0df84b276b9d2a2a7c0e5698a5de6d5d56aae7754dfa
    Brand
    WhatsApp
    Addresses
    91.199.133.247 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    i-whatsapp.cyou
    Registered
    2026-03-28 · Gname.com Pte. Ltd.
    MX
    Receives mail at mx.i-whatsapp.cyou
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  33. www.api-whatsapp.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    www.api-whatsapp.online
    First seen
    2026-11-01 14:06 UTC
    First published
    2026-11-01 14:12 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-01 13:06 UTC to 2027-01-30 13:05 UTC
    Logged 2026-11-01 14:04 UTC in Google ParcelYard2027h1, entry 556,272,408
    SHA-256 d1c65f16011d6b4c5679f8867bdc08eec887313b7f9adc2e10ec55a522e71a46
    Public key SHA-256 c80128bebba55da88447c30e01297cdd87866a30a600137c52f54c9e5d9a0993
    Brand
    WhatsApp
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    api-whatsapp.online
    Registered
    2026-02-25 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  34. www.api-whatsapp.net CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    www.api-whatsapp.net
    First seen
    2026-11-01 14:06 UTC
    First published
    2026-11-01 14:12 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-01 13:06 UTC to 2027-01-30 13:06 UTC
    Logged 2026-11-01 14:04 UTC in Google ParcelYard2027h1, entry 556,275,341
    SHA-256 20e75e61e4bf20debb21e794a1f4ad1b26862c133d5610c775d4ae338522a6f0
    Public key SHA-256 1e520fac0c6eaa95dc2c196029ce49fe0e02650bb99445580aaea806873e60be
    Brand
    WhatsApp
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    api-whatsapp.net
    Registered
    2026-02-25 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  35. api-whatsapp.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    api-whatsapp.online
    First seen
    2026-11-01 14:06 UTC
    First published
    2026-11-01 14:12 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-01 13:06 UTC to 2027-01-30 13:05 UTC
    Logged 2026-11-01 14:04 UTC in Google ParcelYard2027h1, entry 556,272,408
    SHA-256 d1c65f16011d6b4c5679f8867bdc08eec887313b7f9adc2e10ec55a522e71a46
    Public key SHA-256 c80128bebba55da88447c30e01297cdd87866a30a600137c52f54c9e5d9a0993
    Brand
    WhatsApp
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    api-whatsapp.online
    Registered
    2026-02-25 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  36. api-whatsapp.net CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    api-whatsapp.net
    First seen
    2026-11-01 14:06 UTC
    First published
    2026-11-01 14:12 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-01 13:06 UTC to 2027-01-30 13:06 UTC
    Logged 2026-11-01 14:04 UTC in Google ParcelYard2027h1, entry 556,275,341
    SHA-256 20e75e61e4bf20debb21e794a1f4ad1b26862c133d5610c775d4ae338522a6f0
    Public key SHA-256 1e520fac0c6eaa95dc2c196029ce49fe0e02650bb99445580aaea806873e60be
    Brand
    WhatsApp
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    api-whatsapp.net
    Registered
    2026-02-25 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  37. www.sll-whatsapp.icu MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    www.sll-whatsapp.icu
    First seen
    2026-11-01 13:21 UTC
    First published
    2026-11-01 14:12 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.199.133.247.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.199.133.247
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-01 12:18 UTC to 2027-01-30 12:18 UTC
    Logged 2026-11-01 13:16 UTC in Geomys Tuscolo2027h1, entry 432,827,970
    SHA-256 01894218104a6776eb253fde38ff0a31c8b5378353d3545bb489b9fce3f98a8c
    Public key SHA-256 e362ad9c37ba98d8b22dd615612f84c28da969b7ac09a5b7a35c7550b7702099
    Brand
    WhatsApp
    Addresses
    91.199.133.247 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    sll-whatsapp.icu
    Registered
    2026-03-01 · Gname.com Pte. Ltd.
    MX
    Receives mail at mx.sll-whatsapp.icu
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  38. sll-whatsapp.icu MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    sll-whatsapp.icu
    First seen
    2026-11-01 13:21 UTC
    First published
    2026-11-01 14:12 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.199.133.247.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.199.133.247
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-01 12:18 UTC to 2027-01-30 12:18 UTC
    Logged 2026-11-01 13:16 UTC in Geomys Tuscolo2027h1, entry 432,827,970
    SHA-256 01894218104a6776eb253fde38ff0a31c8b5378353d3545bb489b9fce3f98a8c
    Public key SHA-256 e362ad9c37ba98d8b22dd615612f84c28da969b7ac09a5b7a35c7550b7702099
    Brand
    WhatsApp
    Addresses
    91.199.133.247 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    sll-whatsapp.icu
    Registered
    2026-03-01 · Gname.com Pte. Ltd.
    MX
    Receives mail at mx.sll-whatsapp.icu
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  39. www.web-whatsapp.lol MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    www.web-whatsapp.lol
    First seen
    2026-10-31 20:28 UTC
    First published
    2026-10-31 21:14 UTC
    DNS
    Resolves · checked 2026-11-04 21:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 37.221.67.157.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 37.221.67.157
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 19:25 UTC to 2027-01-29 19:25 UTC
    Logged 2026-10-31 20:23 UTC in Google PlumbersArms2027h1, entry 545,137,662
    SHA-256 1be73b08f679153a6ab8d2cea8acdfb6453b5a594454f18c65dff1252deda415
    Public key SHA-256 9fde6ef37749e18a1581113c62ba1ee2fe1973d4cc821280dc20f1b00a148a66
    Brand
    WhatsApp
    Addresses
    37.221.67.157 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    web-whatsapp.lol
    Registered
    2026-04-16 · Gname.com Pte. Ltd.
    MX
    Receives mail at mail.web-whatsapp.lol
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:09 UTC

    Suggest a correction

  40. web-whatsapp.lol MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    web-whatsapp.lol
    First seen
    2026-10-31 20:27 UTC
    First published
    2026-10-31 21:14 UTC
    DNS
    Resolves · checked 2026-11-04 21:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 37.221.67.157.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 37.221.67.157
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 19:25 UTC to 2027-01-29 19:25 UTC
    Logged 2026-10-31 20:23 UTC in Google PlumbersArms2027h1, entry 545,137,662
    SHA-256 1be73b08f679153a6ab8d2cea8acdfb6453b5a594454f18c65dff1252deda415
    Public key SHA-256 9fde6ef37749e18a1581113c62ba1ee2fe1973d4cc821280dc20f1b00a148a66
    Brand
    WhatsApp
    Addresses
    37.221.67.157 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    web-whatsapp.lol
    Registered
    2026-04-16 · Gname.com Pte. Ltd.
    MX
    Receives mail at mail.web-whatsapp.lol
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:09 UTC

    Suggest a correction

  41. www.i-whatsapp.icu MD · AS200019 · AlexHost ALEXHOST S.R.L.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    www.i-whatsapp.icu
    First seen
    2026-10-31 18:11 UTC
    First published
    2026-10-30 12:50 UTC
    DNS
    Resolves · checked 2026-11-04 13:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.199.133.247.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.199.133.247
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-31 17:09 UTC to 2027-01-29 17:09 UTC
    Logged 2026-10-31 18:08 UTC in Google ParcelYard2027h1, entry 542,962,931
    SHA-256 4754cdd9923065ee53e68ea18253fa113d31f256e4c8c6eea4801689a56749a0
    Public key SHA-256 d6859396a124ed11840f8c6c66007109898fa0d7af4e553e70190c054a03ab13
    Brand
    WhatsApp
    Addresses
    91.199.133.247 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    85.121.4.201 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    i-whatsapp.icu
    Registered
    2026-03-28 · Gname.com Pte. Ltd.
    MX
    Receives mail at mx.i-whatsapp.icu
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:06 UTC

    Suggest a correction

  42. i-whatsapp.icu MD · AS200019 · AlexHost ALEXHOST S.R.L.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    i-whatsapp.icu
    First seen
    2026-10-31 18:11 UTC
    First published
    2026-10-30 12:50 UTC
    DNS
    Resolves · checked 2026-11-04 13:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.199.133.247.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.199.133.247
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-31 17:09 UTC to 2027-01-29 17:09 UTC
    Logged 2026-10-31 18:08 UTC in Google ParcelYard2027h1, entry 542,962,931
    SHA-256 4754cdd9923065ee53e68ea18253fa113d31f256e4c8c6eea4801689a56749a0
    Public key SHA-256 d6859396a124ed11840f8c6c66007109898fa0d7af4e553e70190c054a03ab13
    Brand
    WhatsApp
    Addresses
    91.199.133.247 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    85.121.4.201 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    i-whatsapp.icu
    Registered
    2026-03-28 · Gname.com Pte. Ltd.
    MX
    Receives mail at mx.i-whatsapp.icu
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:06 UTC

    Suggest a correction

  43. www.sol-whatsapp.lol MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.sol-whatsapp.lol
    First seen
    2026-10-31 13:56 UTC
    First published
    2026-10-31 14:27 UTC
    DNS
    Resolves · checked 2026-11-04 14:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 37.221.67.157.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 37.221.67.157
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-31 12:55 UTC to 2027-01-29 12:55 UTC
    Logged 2026-10-31 13:53 UTC in Geomys Tuscolo2027h1, entry 420,558,085
    SHA-256 191eccf19383aa9c37a80afe0307d4d30983d443dbbebbade28b08f81677d269
    Public key SHA-256 c7cc905c2ce9c5483bc3349a3da4c4442d490462b7b35130a42ea65cb4739983
    Brand
    WhatsApp
    Addresses
    37.221.67.157 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    sol-whatsapp.lol
    Registered
    2026-04-25 · Gname.com Pte. Ltd.
    MX
    Receives mail at mail.sol-whatsapp.lol
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:08 UTC

    Suggest a correction

  44. sol-whatsapp.lol MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    sol-whatsapp.lol
    First seen
    2026-10-31 13:56 UTC
    First published
    2026-10-31 14:27 UTC
    DNS
    Resolves · checked 2026-11-04 14:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 37.221.67.157.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 37.221.67.157
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-31 12:55 UTC to 2027-01-29 12:55 UTC
    Logged 2026-10-31 13:53 UTC in Geomys Tuscolo2027h1, entry 420,558,085
    SHA-256 191eccf19383aa9c37a80afe0307d4d30983d443dbbebbade28b08f81677d269
    Public key SHA-256 c7cc905c2ce9c5483bc3349a3da4c4442d490462b7b35130a42ea65cb4739983
    Brand
    WhatsApp
    Addresses
    37.221.67.157 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    sol-whatsapp.lol
    Registered
    2026-04-25 · Gname.com Pte. Ltd.
    MX
    Receives mail at mail.sol-whatsapp.lol
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:08 UTC

    Suggest a correction

  45. www.handwerker-whatsapp.de CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.handwerker-whatsapp.de
    First seen
    2026-10-31 13:06 UTC
    First published
    2026-10-31 13:42 UTC
    DNS
    Resolves · checked 2026-11-04 13:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-31 12:06 UTC to 2027-01-29 12:06 UTC
    Logged 2026-10-31 13:04 UTC in IPng Networks Gouda2027h1, entry 278,253,867
    SHA-256 4627ac1745d89fbf93626b1a82e2fa19f594f180106be3865c059af817e68846
    Public key SHA-256 1337f10ce67d9a470921999714ff80b5f485f4a304f53d782b9ca0418f3c5ade
    Brand
    WhatsApp
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    handwerker-whatsapp.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  46. handwerker-whatsapp.de CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    handwerker-whatsapp.de
    First seen
    2026-10-31 13:06 UTC
    First published
    2026-10-31 13:42 UTC
    DNS
    Resolves · checked 2026-11-04 13:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-31 12:06 UTC to 2027-01-29 12:06 UTC
    Logged 2026-10-31 13:04 UTC in IPng Networks Gouda2027h1, entry 278,253,867
    SHA-256 4627ac1745d89fbf93626b1a82e2fa19f594f180106be3865c059af817e68846
    Public key SHA-256 1337f10ce67d9a470921999714ff80b5f485f4a304f53d782b9ca0418f3c5ade
    Brand
    WhatsApp
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    handwerker-whatsapp.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  47. delivery-whatsapp.paineldemonstrativo.com.br DE · AS51167 · CONTABO Contabo GmbH
    Phishing hostContaboAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 15 y ago
    DetailsHide
    Hostname
    delivery-whatsapp.paineldemonstrativo.com.br
    First seen
    2026-10-31 06:42 UTC
    First published
    2026-10-31 07:17 UTC
    DNS
    Resolves · checked 2026-11-05 07:22 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 173.212.222.253.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 173.212.222.253
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-31 05:40 UTC to 2027-01-29 05:40 UTC
    Logged 2026-10-31 06:39 UTC in Google ParcelYard2027h1, entry 534,837,480
    SHA-256 200b49e61c07f8d46bfa27f111aee861dc68d9e58c5a47f895f2ceee05f128dc
    Public key SHA-256 62e8c41d9357bb4853a9e7a8e369c207b7d9bd77494e61674999c055caab3a6a
    Brand
    WhatsApp
    Addresses
    173.212.222.253 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    Contabo
    Contabo (173.212.222.253): a cloud provider. It rents servers and addresses to its customers.
    Domain
    paineldemonstrativo.com.br
    Registered
    2012-02-04
    MX
    Receives mail at mx-vip-01.uni5.net, mx-vip-02.uni5.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  48. whatsapp.wei-support.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under wei-support.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    whatsapp.wei-support.com
    First seen
    2026-10-30 16:36 UTC
    First published
    2026-10-30 17:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 17:13 UTC
    Listed
    MetaMask, listing wei-support.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-30 15:32 UTC to 2027-01-28 15:32 UTC
    Logged 2026-10-30 16:31 UTC in IPng Networks Gouda2027h1, entry 271,635,922
    SHA-256 4d8e76c07b6ee205193de0cc4a4fd07464a812267236f7b462cd03a0cfc2edf4
    Public key SHA-256 818535e2ce5457e050bf7f38f5905d152c86fc4821ce6fb7a280b70007487bb5
    Brand
    WhatsApp
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    wei-support.com
    Registered
    2026-05-17 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  49. ouss.uoabse-whatsapp.com NL · AS218253 · Airnode Ivo de Witte tradin…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    ouss.uoabse-whatsapp.com
    First seen
    2026-10-30 13:52 UTC
    First published
    2026-10-30 14:56 UTC
    DNS
    Not resolving since 2026-10-30 · checked 2026-11-04 15:03 UTC
    Checks
    Overdue since 2026-10-30 14:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.5.85.50.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 163.5.85.50
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-30 12:49 UTC to 2027-01-28 12:49 UTC
    Logged 2026-10-30 13:48 UTC in IPng Networks Halloumi2027h1, entry 313,038,506
    SHA-256 25ae9698b8fca0c1eec5d836aa49371e77508725c0598edd6c04fa3d00446624
    Public key SHA-256 cc48c24916a2fc83974df832dc60261a4e6950dedc5396b67847ec9ebbded460
    Brand
    WhatsApp
    Addresses
    163.5.85.50 · Netherlands · AS218253 Airnode Ivo de Witte trading as Airnode Hosting
    Domain
    uoabse-whatsapp.com
    Registered
    2026-10-30 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  50. oupp.uoabse-whatsapp.com NL · AS218253 · Airnode Ivo de Witte tradin…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    oupp.uoabse-whatsapp.com
    First seen
    2026-10-30 13:52 UTC
    First published
    2026-10-30 14:56 UTC
    DNS
    Not resolving since 2026-10-30 · checked 2026-11-04 15:03 UTC
    Checks
    Overdue since 2026-10-30 14:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.5.85.50.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 163.5.85.50
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-30 12:49 UTC to 2027-01-28 12:49 UTC
    Logged 2026-10-30 13:48 UTC in Geomys Tuscolo2027h1, entry 408,138,726
    SHA-256 657b54c84c90142273bef677487c65155e7664eb774232403bbde525d20a1c95
    Public key SHA-256 f02038f47472d2df00974c5595eb2a6b2f8cdba6fe126c2a5af5e2e0768fdeca
    Brand
    WhatsApp
    Addresses
    163.5.85.50 · Netherlands · AS218253 Airnode Ivo de Witte trading as Airnode Hosting
    Domain
    uoabse-whatsapp.com
    Registered
    2026-10-30 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  51. oull.uoabse-whatsapp.com NL · AS218253 · Airnode Ivo de Witte tradin…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    oull.uoabse-whatsapp.com
    First seen
    2026-10-30 13:52 UTC
    First published
    2026-10-30 14:56 UTC
    DNS
    Not resolving since 2026-10-30 · checked 2026-11-04 15:03 UTC
    Checks
    Overdue since 2026-10-30 14:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.5.85.50.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 163.5.85.50
    Certificate
    Issued by YR1
    Valid 2026-10-30 12:49 UTC to 2027-01-28 12:49 UTC
    Logged 2026-10-30 13:48 UTC in Google ParcelYard2027h1, entry 523,372,971
    SHA-256 a870732d3511b5ceac979061fd64bbfe2a93879ec70630e3912546fbda030d54
    Public key SHA-256 ff917695c031a04d4835560b130bd9de5989fd36dfb0bd00b4b389354e0e2b10
    Brand
    WhatsApp
    Addresses
    163.5.85.50 · Netherlands · AS218253 Airnode Ivo de Witte trading as Airnode Hosting
    Domain
    uoabse-whatsapp.com
    Registered
    2026-10-30 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  52. ouaa.uoabse-whatsapp.com NL · AS218253 · Airnode Ivo de Witte tradin…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    ouaa.uoabse-whatsapp.com
    First seen
    2026-10-30 13:52 UTC
    First published
    2026-10-30 14:56 UTC
    DNS
    Not resolving since 2026-10-30 · checked 2026-11-04 15:03 UTC
    Checks
    Overdue since 2026-10-30 14:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.5.85.50.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 163.5.85.50
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-30 12:49 UTC to 2027-01-28 12:49 UTC
    Logged 2026-10-30 13:48 UTC in Let's Encrypt Willow2027h1, entry 850,148,208
    SHA-256 bc8134c875366cf9f6140bbe4a75311abd65b636603db3a435156b0fe9d115d3
    Public key SHA-256 4b7d76e7d6686af6fa9805820044c90f09545ccc0ac64900f8532ab84d3669a3
    Brand
    WhatsApp
    Addresses
    163.5.85.50 · Netherlands · AS218253 Airnode Ivo de Witte trading as Airnode Hosting
    Domain
    uoabse-whatsapp.com
    Registered
    2026-10-30 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  53. uoabse-whatsapp.com NL · AS218253 · Airnode Ivo de Witte tradin…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    uoabse-whatsapp.com
    First seen
    2026-10-30 13:26 UTC
    First published
    2026-10-30 13:53 UTC
    DNS
    Not resolving since 2026-10-31 · checked 2026-11-04 14:01 UTC
    Checks
    Overdue since 2026-10-31 13:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.5.85.50.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 163.5.85.50
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-30 12:26 UTC to 2027-01-28 12:26 UTC
    Logged 2026-10-30 13:24 UTC in Geomys Tuscolo2027h1, entry 407,919,618
    SHA-256 562fcab63d6f05e16c659d33323052124f6fb2f4237723de2e565ab43d0e2d8a
    Public key SHA-256 5923701cfaf70dfbf208e7506d80bc4008b2206350ebeaeb7689df75bfd0922c
    Brand
    WhatsApp
    Addresses
    163.5.85.50 · Netherlands · AS218253 Airnode Ivo de Witte trading as Airnode Hosting
    Domain
    uoabse-whatsapp.com
    Registered
    2026-10-30 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  54. www.ios-whatsapp.cyou MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    www.ios-whatsapp.cyou
    First seen
    2026-10-30 07:26 UTC
    First published
    2026-10-30 07:37 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 81.180.92.199.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 81.180.92.199
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 06:22 UTC to 2027-01-28 06:22 UTC
    Logged 2026-10-30 07:20 UTC in Google PlumbersArms2027h1, entry 519,404,100
    SHA-256 1054d577fdaccf8f3596b41b89d8af1fdfd4cef93d191ff3cde3995920ee2da0
    Public key SHA-256 43fa146aa2ff0caf0c1defde070367a0f437f978f527abd080486e6e34067228
    Brand
    WhatsApp
    Addresses
    81.180.92.199 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    ios-whatsapp.cyou
    Registered
    2026-04-01 · Gname.com Pte. Ltd.
    MX
    Receives mail at mail.ios-whatsapp.cyou
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:07 UTC

    Suggest a correction

  55. ios-whatsapp.cyou MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    ios-whatsapp.cyou
    First seen
    2026-10-30 07:26 UTC
    First published
    2026-10-30 07:37 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 81.180.92.199.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 81.180.92.199
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 06:22 UTC to 2027-01-28 06:22 UTC
    Logged 2026-10-30 07:20 UTC in Google PlumbersArms2027h1, entry 519,404,100
    SHA-256 1054d577fdaccf8f3596b41b89d8af1fdfd4cef93d191ff3cde3995920ee2da0
    Public key SHA-256 43fa146aa2ff0caf0c1defde070367a0f437f978f527abd080486e6e34067228
    Brand
    WhatsApp
    Addresses
    81.180.92.199 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    ios-whatsapp.cyou
    Registered
    2026-04-01 · Gname.com Pte. Ltd.
    MX
    Receives mail at mail.ios-whatsapp.cyou
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:07 UTC

    Suggest a correction

  56. staticweb-web-whatsapp.com HK · AS138415 · Yancy Limited
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    staticweb-web-whatsapp.com
    First seen
    2026-10-30 06:22 UTC
    First published
    2026-10-30 06:35 UTC
    DNS
    Not resolving since 2026-11-02 · checked 2026-11-05 06:39 UTC
    Checks
    Overdue since 2026-11-02 06:37 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 23.248.233.214.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 23.248.233.214
    Certificate
    Issued by YR2
    Valid 2026-10-30 05:19 UTC to 2027-01-28 05:19 UTC
    Logged 2026-10-30 06:17 UTC in Google ParcelYard2027h1, entry 517,990,583
    SHA-256 3a54a1185dd03cf2e0f588af61c675f065070b213242741bc9d8daa330d507db
    Public key SHA-256 7dca86a7e6d80ccffd977d7cdf9c223f90457380ddf5390130499e58a60317bc
    Brand
    WhatsApp
    Addresses
    23.248.233.214 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    staticweb-web-whatsapp.com
    Registered
    2026-10-26 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  57. www.whatsapp.mauryabilling.in DE · AS24940 · HETZNER-AS Hetzner Online G…
    ListedHetznerUnder mauryabilling.in, listed by CERT PolskaMX presentSPF ~allDMARC policy noneRegistered 22 mo ago
    DetailsHide
    Hostname
    www.whatsapp.mauryabilling.in
    First seen
    2026-10-29 17:30 UTC
    First published
    2026-10-29 18:29 UTC
    Listing
    CERT Polska listed it 2026-08-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:34 UTC
    Listed
    CERT Polska, listing mauryabilling.in and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 16:29 UTC to 2027-01-27 16:29 UTC
    Logged 2026-10-29 17:27 UTC in Google PlumbersArms2027h1, entry 510,102,018
    SHA-256 5a531914c6fce83728a3bf7b3d4e8916aba9784b8e8a9434c239007bef9f4f0c
    Public key SHA-256 28d32187388940ba83e359033348c5cf8f09a50df556c7c3f1412d9d0a99d1ba
    Brand
    WhatsApp
    Addresses
    157.90.1.43 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (157.90.1.43): a cloud provider. It rents servers and addresses to its customers.
    Domain
    mauryabilling.in
    Registered
    2025-01-16 · HOSTINGER operations, UAB
    MX
    Receives mail at mauryabilling.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  58. www.rtl-whatsapp.com HK · AS55933 · Cloudie Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    www.rtl-whatsapp.com
    First seen
    2026-10-29 13:37 UTC
    First published
    2026-10-29 14:18 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.119.0.20.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.119.0.20
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 12:35 UTC to 2027-01-27 12:35 UTC
    Logged 2026-10-29 13:33 UTC in Google PlumbersArms2027h1, entry 507,175,760
    SHA-256 3fda182adf06c5c3693d975b7df0168046f0b3440cc82e82064caf47128c894a
    Public key SHA-256 ee4c4bdc842ae3480ac62d9647daed7bdd1e9ee2c209ac391817f9e17dbbecb3
    Brand
    WhatsApp
    Addresses
    103.119.0.20 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
    Domain
    rtl-whatsapp.com
    Registered
    2025-12-07 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  59. www.cn-whats-app.com HK · AS55933 · Cloudie Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    www.cn-whats-app.com
    First seen
    2026-10-29 13:37 UTC
    First published
    2026-10-29 14:18 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.119.0.20.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.119.0.20
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 12:34 UTC to 2027-01-27 12:34 UTC
    Logged 2026-10-29 13:33 UTC in DigiCert Sphinx2027h1, entry 306,587,394
    SHA-256 df4f651ee030e74a7e039f8f0523dcaf50340ab2e1f5b361bd5c16605f7b8e08
    Public key SHA-256 2bf2ce218bfd5f10cfb05543bc330fb5aa9e25d21160973e0b1954131d7fa18e
    Brand
    WhatsApp
    Addresses
    103.119.0.20 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
    Domain
    cn-whats-app.com
    Registered
    2025-11-29 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  60. wap.rtl-whatsapp.com HK · AS55933 · Cloudie Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    wap.rtl-whatsapp.com
    First seen
    2026-10-29 13:37 UTC
    First published
    2026-10-29 14:18 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.119.0.20.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.119.0.20
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 12:35 UTC to 2027-01-27 12:35 UTC
    Logged 2026-10-29 13:33 UTC in Google PlumbersArms2027h1, entry 507,175,760
    SHA-256 3fda182adf06c5c3693d975b7df0168046f0b3440cc82e82064caf47128c894a
    Public key SHA-256 ee4c4bdc842ae3480ac62d9647daed7bdd1e9ee2c209ac391817f9e17dbbecb3
    Brand
    WhatsApp
    Addresses
    103.119.0.20 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
    Domain
    rtl-whatsapp.com
    Registered
    2025-12-07 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  61. wap.cn-whats-app.com HK · AS55933 · Cloudie Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    wap.cn-whats-app.com
    First seen
    2026-10-29 13:37 UTC
    First published
    2026-10-29 14:18 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.119.0.20.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.119.0.20
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 12:34 UTC to 2027-01-27 12:34 UTC
    Logged 2026-10-29 13:33 UTC in DigiCert Sphinx2027h1, entry 306,587,394
    SHA-256 df4f651ee030e74a7e039f8f0523dcaf50340ab2e1f5b361bd5c16605f7b8e08
    Public key SHA-256 2bf2ce218bfd5f10cfb05543bc330fb5aa9e25d21160973e0b1954131d7fa18e
    Brand
    WhatsApp
    Addresses
    103.119.0.20 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
    Domain
    cn-whats-app.com
    Registered
    2025-11-29 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  62. rtl-whatsapp.com HK · AS55933 · Cloudie Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    rtl-whatsapp.com
    First seen
    2026-10-29 13:36 UTC
    First published
    2026-10-29 14:18 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.119.0.20.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.119.0.20
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 12:35 UTC to 2027-01-27 12:35 UTC
    Logged 2026-10-29 13:33 UTC in Google PlumbersArms2027h1, entry 507,175,760
    SHA-256 3fda182adf06c5c3693d975b7df0168046f0b3440cc82e82064caf47128c894a
    Public key SHA-256 ee4c4bdc842ae3480ac62d9647daed7bdd1e9ee2c209ac391817f9e17dbbecb3
    Brand
    WhatsApp
    Addresses
    103.119.0.20 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
    Domain
    rtl-whatsapp.com
    Registered
    2025-12-07 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  63. m.rtl-whatsapp.com HK · AS55933 · Cloudie Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    m.rtl-whatsapp.com
    First seen
    2026-10-29 13:36 UTC
    First published
    2026-10-29 14:18 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.119.0.20.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.119.0.20
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 12:35 UTC to 2027-01-27 12:35 UTC
    Logged 2026-10-29 13:33 UTC in Google PlumbersArms2027h1, entry 507,175,760
    SHA-256 3fda182adf06c5c3693d975b7df0168046f0b3440cc82e82064caf47128c894a
    Public key SHA-256 ee4c4bdc842ae3480ac62d9647daed7bdd1e9ee2c209ac391817f9e17dbbecb3
    Brand
    WhatsApp
    Addresses
    103.119.0.20 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
    Domain
    rtl-whatsapp.com
    Registered
    2025-12-07 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  64. m.cn-whats-app.com HK · AS55933 · Cloudie Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    m.cn-whats-app.com
    First seen
    2026-10-29 13:36 UTC
    First published
    2026-10-29 14:18 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.119.0.20.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.119.0.20
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 12:34 UTC to 2027-01-27 12:34 UTC
    Logged 2026-10-29 13:33 UTC in DigiCert Sphinx2027h1, entry 306,587,394
    SHA-256 df4f651ee030e74a7e039f8f0523dcaf50340ab2e1f5b361bd5c16605f7b8e08
    Public key SHA-256 2bf2ce218bfd5f10cfb05543bc330fb5aa9e25d21160973e0b1954131d7fa18e
    Brand
    WhatsApp
    Addresses
    103.119.0.20 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
    Domain
    cn-whats-app.com
    Registered
    2025-11-29 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  65. cn-whats-app.com HK · AS55933 · Cloudie Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    cn-whats-app.com
    First seen
    2026-10-29 13:36 UTC
    First published
    2026-10-29 14:18 UTC
    DNS
    Resolves · checked 2026-11-04 14:23 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.119.0.20.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.119.0.20
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 12:34 UTC to 2027-01-27 12:34 UTC
    Logged 2026-10-29 13:33 UTC in DigiCert Sphinx2027h1, entry 306,587,394
    SHA-256 df4f651ee030e74a7e039f8f0523dcaf50340ab2e1f5b361bd5c16605f7b8e08
    Public key SHA-256 2bf2ce218bfd5f10cfb05543bc330fb5aa9e25d21160973e0b1954131d7fa18e
    Brand
    WhatsApp
    Addresses
    103.119.0.20 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
    Domain
    cn-whats-app.com
    Registered
    2025-11-29 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  66. www.join-whatsapp.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    www.join-whatsapp.online
    First seen
    2026-10-29 06:41 UTC
    First published
    2026-10-29 06:44 UTC
    DNS
    Not resolving since 2026-10-30 · checked 2026-11-05 06:51 UTC
    Checks
    Overdue since 2026-10-30 06:48 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 05:38 UTC to 2027-01-27 05:38 UTC
    Logged 2026-10-29 06:36 UTC in Let's Encrypt Willow2027h1, entry 827,702,301
    SHA-256 4a1a12af42d4c56dcbd4ea18c9b5e0690715eb8b6cd044c46bec10695da8bfe4
    Public key SHA-256 2f928cb7e6cbad4e659d4a657e28980673e49a397d384f233053b66fe447b3ae
    Brand
    WhatsApp
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    join-whatsapp.online
    Registered
    2026-10-29 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  67. join-whatsapp.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    join-whatsapp.online
    First seen
    2026-10-29 06:41 UTC
    First published
    2026-10-29 06:44 UTC
    DNS
    Not resolving since 2026-10-30 · checked 2026-11-05 06:51 UTC
    Checks
    Overdue since 2026-10-30 06:48 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 05:38 UTC to 2027-01-27 05:38 UTC
    Logged 2026-10-29 06:36 UTC in Let's Encrypt Willow2027h1, entry 827,702,301
    SHA-256 4a1a12af42d4c56dcbd4ea18c9b5e0690715eb8b6cd044c46bec10695da8bfe4
    Public key SHA-256 2f928cb7e6cbad4e659d4a657e28980673e49a397d384f233053b66fe447b3ae
    Brand
    WhatsApp
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    join-whatsapp.online
    Registered
    2026-10-29 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  68. wed-whatsapp.me HK · AS152194 · CTG Server Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    wed-whatsapp.me
    First seen
    2026-10-29 06:26 UTC
    First published
    2026-10-29 06:44 UTC
    DNS
    Resolves · checked 2026-11-05 06:51 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 143.92.58.197.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 143.92.58.197
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 05:22 UTC to 2027-01-27 05:22 UTC
    Logged 2026-10-29 06:21 UTC in Google PlumbersArms2027h1, entry 501,646,716
    SHA-256 3c9520b3eb3de576d69acd9e0282f9b8534527ae5222c5f4d82be5ab880ffc8a
    Public key SHA-256 d0a6e84f15028dd6dc462dbff8e1e1661661ac88a55711fecb09ac995027a8ec
    Brand
    WhatsApp
    Addresses
    143.92.58.197 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    wed-whatsapp.me
    Registered
    2026-04-04 · GNAME.COM PTE. LTD.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  69. wde-whatsapp.com HK · AS152194 · CTG Server Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    wde-whatsapp.com
    First seen
    2026-10-29 06:21 UTC
    First published
    2026-10-29 06:44 UTC
    DNS
    Resolves · checked 2026-11-05 06:51 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 143.92.58.197.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 143.92.58.197
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 05:20 UTC to 2027-01-27 05:20 UTC
    Logged 2026-10-29 06:19 UTC in Google PlumbersArms2027h1, entry 501,627,663
    SHA-256 15bc5f04bd68a64c6fe6655639f106a0d5d82cad9423616cb27465c6cad18311
    Public key SHA-256 19675e2e274841b9e6c99383376da921d0ef627593fdd85f5b6dbbe9accc70f0
    Brand
    WhatsApp
    Addresses
    143.92.58.197 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    wde-whatsapp.com
    Registered
    2026-04-04 · Name SRS AB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  70. wbe-whatsapp.com HK · AS152194 · CTG Server Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    wbe-whatsapp.com
    First seen
    2026-10-29 06:21 UTC
    First published
    2026-10-29 06:44 UTC
    DNS
    Resolves · checked 2026-11-05 06:51 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 143.92.58.197.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 143.92.58.197
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-29 05:17 UTC to 2027-01-27 05:17 UTC
    Logged 2026-10-29 06:16 UTC in Google PlumbersArms2027h1, entry 501,598,601
    SHA-256 75d96c61fa10c500f6efd431e70e0bedc25e600e2adcdf4bebe80d9133920b15
    Public key SHA-256 960b32591ab524bc8fa68d896b80a964c58afd239984ee30f76a53242a37978e
    Brand
    WhatsApp
    Addresses
    143.92.58.197 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    wbe-whatsapp.com
    Registered
    2025-09-06 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  71. webwebin-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 14 d ago
    DetailsHide
    Hostname
    webwebin-whatsapp.com
    First seen
    2026-10-29 06:05 UTC
    First published
    2026-10-29 06:44 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-02 · checked 2026-11-05 06:51 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-10-29 00:00 UTC to 2027-01-23 15:07 UTC
    Logged 2026-10-29 06:03 UTC in DigiCert Wyvern2027h1, entry 343,801,135
    SHA-256 78163fdbbdf387bc85089425a4c60391f03f011edad3a3e3e216e0d554d69b73
    Public key SHA-256 ff39ae5d7ec6f1430c95d3eb532753bfe574fba49a57bc32b97c5b4f91f1913f
    Brand
    WhatsApp
    Domain
    webwebin-whatsapp.com
    Registered
    2026-10-22 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  72. vpn.whatsappweb-news.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under whatsappweb-news.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    vpn.whatsappweb-news.com
    First seen
    2026-10-28 22:56 UTC
    First published
    2026-10-28 23:28 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:41 UTC
    Reported
    PhishDestroy, listing whatsappweb-news.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-28 21:56 UTC to 2027-01-26 21:56 UTC
    Logged 2026-10-28 22:55 UTC in DigiCert Sphinx2027h1, entry 299,442,403
    SHA-256 b4db4a26dbd8e9b82b02de734ac00b06a4a58ae9f084f96ecf294e3a917d8cbf
    Public key SHA-256 d83b5bf20df0c62d53400e306157393f59dcd3cccdf1512e52902af55de5fd87
    PhishDestroy
    Brand
    WhatsApp
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    whatsappweb-news.com
    Registered
    2026-05-20 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:42 UTC

    Suggest a correction

  73. www.whatsapp-services.promitix.com FR · AS16276 · OVH OVH SAS
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 21 mo ago
    DetailsHide
    Hostname
    www.whatsapp-services.promitix.com
    First seen
    2026-10-28 12:42 UTC
    First published
    2026-10-28 13:04 UTC
    DNS
    Resolves · checked 2026-11-04 13:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 148.113.35.66.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 148.113.35.66
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-28 11:39 UTC to 2027-01-26 11:39 UTC
    Logged 2026-10-28 12:37 UTC in DigiCert Wyvern2027h1, entry 333,992,964
    SHA-256 29f9503cd59421f0c9f6b2b26dc60ba369f3158006fd0b66f2cb90ee11e80773
    Public key SHA-256 8b1d40ac1488817ba2b54365f921ac2a915d072cff48d8e94857354ff388e849
    Brand
    WhatsApp
    Addresses
    148.113.35.66 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (148.113.35.66): a cloud provider. It rents servers and addresses to its customers.
    Domain
    promitix.com
    Registered
    2025-02-22 · OwnRegistrar, Inc.
    MX
    Receives mail at promitix.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  74. businessweb-whatsapp.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 19 d ago
    DetailsHide
    Hostname
    businessweb-whatsapp.com
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-02 · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Certificate logged in CT
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-05 00:00 UTC to 2027-02-01 13:37 UTC
    Logged 2026-11-05 01:55 UTC in Let's Encrypt Sycamore2027h1, entry 951,233,379
    SHA-256 1ea57dd36445a76e3ee7d55a4b5ca4b31b14f8e24f1e81b73656b7b3d02ab6bc
    Public key SHA-256 e6161b5faca31dbd7375e365c8bd89da00236a7797b4abbdf4dd1d120a80e04e
    Brand
    WhatsApp
    Domain
    businessweb-whatsapp.com
    Registered
    2026-10-17 · Vantage of Convergence (Chengdu) Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  75. last-whatsapp.com HK · AS138415 · Yancy Limited2 addresses
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 d ago
    DetailsHide
    Hostname
    last-whatsapp.com
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-29 · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    WhatsApp
    Addresses
    156.234.58.212 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.58.213 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    last-whatsapp.com
    Registered
    2026-10-25 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:33 UTC

    Suggest a correction

  76. web-wa-whatsapp.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 d ago
    DetailsHide
    Hostname
    web-wa-whatsapp.com
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:05 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    WhatsApp
    Addresses
    104.21.27.69 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.169.9 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::ac43:a909
    2606:4700:3037::6815:1b45
    Cloudflare
    Cloudflare (104.21.27.69, 172.67.169.9): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    web-wa-whatsapp.com
    Registered
    2026-10-25 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  77. co-vvhatsapp.cyou US · AS219502 · STORMCLOUD-AS Storm Industr…Lookalike of whatsapp.com · similar-looking characters
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    co-vvhatsapp.cyou
    First seen
    2026-10-26 13:06 UTC
    DNS
    Not resolving since 2026-10-30 · checked 2026-11-05 09:04 UTC
    Checks
    Overdue since 2026-10-30 09:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 94.154.43.130.
    1. Phishing-host list fetched with the address
    2. Resolved to 94.154.43.130
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 94.154.43.130.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 94.154.43.130
    Certificate
    Logged in Google PlumbersArms2027h1, entry 455,547,221
    SHA-256 09dfec04c84d11d5b91a8dccd6bcfe1ff7f02d18c422c3bf6eaee65cc40d9cfe
    Brand
    WhatsApp (spelled like whatsapp.com with similar-looking characters)
    Addresses
    94.154.43.130 · United States · AS219502 STORMCLOUD-AS Storm Industries LLC
    Domain
    co-vvhatsapp.cyou
    Registered
    2026-10-26 · GLOBAL ASSET DOMAINS INC.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  78. www.whats-app-online.ru RU · AS198610 · BEGET-AS Beget LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF all omittedDMARC missing
    DetailsHide
    Hostname
    www.whats-app-online.ru
    First seen
    2026-10-26 05:29 UTC
    DNS
    Resolves · checked 2026-11-05 09:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 87.236.16.13.
    1. Phishing-host list fetched with the address
    2. Resolved to 87.236.16.13
    3. Latest DNS check
    Certificate
    Logged in Google PlumbersArms2027h1, entry 450,834,136
    SHA-256 65dc90ef24b88ad3cb218fdbcacc6d85cd97acf6ef547151fbca2c1e3419f8c7
    Brand
    WhatsApp
    Addresses
    87.236.16.13 · Russia · AS198610 BEGET-AS Beget LLC
    Domain
    whats-app-online.ru
    MX
    Receives mail at mx1.beget.com, mx2.beget.com
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  79. whats-app-online.ru RU · AS198610 · BEGET-AS Beget LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF all omittedDMARC missing
    DetailsHide
    Hostname
    whats-app-online.ru
    First seen
    2026-10-26 05:29 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 87.236.16.13.
    1. Phishing-host list fetched with the address
    2. Resolved to 87.236.16.13
    3. Latest DNS check
    Certificate
    Logged in Google PlumbersArms2027h1, entry 450,834,136
    SHA-256 65dc90ef24b88ad3cb218fdbcacc6d85cd97acf6ef547151fbca2c1e3419f8c7
    Brand
    WhatsApp
    Addresses
    87.236.16.13 · Russia · AS198610 BEGET-AS Beget LLC
    Domain
    whats-app-online.ru
    MX
    Receives mail at mx1.beget.com, mx2.beget.com
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches WhatsApp when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Messaging

All brands →