{ "id": 684, "key": "d6587d0fe22f", "size": 3, "host_count": 21, "active_count": 21, "brands": [ "whatsapp" ], "confidence": "suspected cluster", "confidence_score": 0.664, "confidence_metrics": { "B": 0.5, "D": 0.372, "S": 1.0, "T": 0.983, "V": 1.0 }, "first_seen": "2026-09-04 17:24:47.788336+00:00", "last_activity": "2026-09-06 05:24:40.020999+00:00", "top_evidence": { "type": "same_ip", "coverage": "3/3 members" }, "url": "https://phishunt.io/campaigns/d6587d0fe22f/", "algorithm_version": "corr-1.3.0", "generated_at": "2026-09-07T05:00:32.125982+00:00", "evidence_summary": [ { "type": "same_ip", "value": "156.234.67.88", "members_matching": 3 }, { "type": "same_ns_set", "value": "ns1.kenpains.com,ns2.kenpains.com", "members_matching": 3 }, { "type": "same_ip", "value": "156.234.67.92", "members_matching": 2 }, { "type": "shared_distinctive_token", "value": "patch", "members_matching": 2 }, { "type": "shared_distinctive_token", "value": "private", "members_matching": 2 }, { "type": "screenshot_phash_full", "value": "9e516136654e3567~9e516136654e3567 d=0", "members_matching": 2 }, { "type": "favicon_phash_exact", "value": "e266cd9993338e92", "members_matching": 2 }, { "type": "ocr_similarity_full", "value": "jaccard=1.00", "members_matching": 2 }, { "type": "shared_final_host", "value": "consent.yahoo.com", "members_matching": 2 }, { "type": "temporal_24h", "value": "0.0h", "members_matching": 2 }, { "type": "domain_age_window", "value": "4d/4d", "members_matching": 2 }, { "type": "domain_age_window", "value": "4d/6d", "members_matching": 2 }, { "type": "temporal_72h", "value": "36.0h", "members_matching": 2 }, { "type": "cert_age_window", "value": "4d/4d", "members_matching": 2 }, { "type": "cert_age_window", "value": "4d/6d", "members_matching": 2 } ], "first_tracked": "2026-09-07T05:00:32.125982+00:00", "history": [ { "at": "2026-09-07T05:00:32.125982+00:00", "event": "created", "size": 3, "joined": [ "build.comm-whatsapp.com", "build.static-whatsapp.com", "calendar.scan-whatsapp.com", "desktop.scan-whatsapp.com", "docs.scan-whatsapp.com", "local.comm-whatsapp.com", "local.static-whatsapp.com", "patch.comm-whatsapp.com", "patch.static-whatsapp.com", "photo.comm-whatsapp.com", "photo.static-whatsapp.com", "premium.comm-whatsapp.com", "premium.static-whatsapp.com", "private.comm-whatsapp.com", "private.static-whatsapp.com", "sandbox.comm-whatsapp.com", "sandbox.static-whatsapp.com", "staging.static-whatsapp.com", "stream.static-whatsapp.com", "works.comm-whatsapp.com", "works.static-whatsapp.com" ], "left": [] } ], "members": [ { "uuid": "a89411a2-c065-4c3c-b4df-f458b7f3cbc3", "domain": "build.comm-whatsapp.com", "registrable_domain": "comm-whatsapp.com", "url": "https://build.comm-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:47.788336+00:00", "relationship_score": 65, "relationship_tier": "high", "detail_url": "https://phishunt.io/suspicious/whatsapp/a89411a2-c065-4c3c-b4df-f458b7f3cbc3/", "image": "screenshots/whatsapp/a89411a2-c065-4c3c-b4df-f458b7f3cbc3.png", "phishunt_score": 37, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR1", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "6051c37f-811b-4687-940e-2218c656b510", "domain": "build.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://build.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.304743+00:00", "relationship_score": null, "relationship_tier": null, "detail_url": "https://phishunt.io/suspicious/whatsapp/6051c37f-811b-4687-940e-2218c656b510/", "image": "screenshots/whatsapp/6051c37f-811b-4687-940e-2218c656b510.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1", "domain": "calendar.scan-whatsapp.com", "registrable_domain": "scan-whatsapp.com", "url": "https://calendar.scan-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:49.355151+00:00", "relationship_score": 65, "relationship_tier": "high", "detail_url": "https://phishunt.io/suspicious/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1/", "image": "screenshots/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1.png", "phishunt_score": 36, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9", "domain": "desktop.scan-whatsapp.com", "registrable_domain": "scan-whatsapp.com", "url": "https://desktop.scan-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:49.547291+00:00", "relationship_score": 59, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "image": "screenshots/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9.png", "phishunt_score": 36, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "3c79f56e-36ac-44b1-9a9a-40562b9a773e", "domain": "docs.scan-whatsapp.com", "registrable_domain": "scan-whatsapp.com", "url": "https://docs.scan-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:49.649919+00:00", "relationship_score": 65, "relationship_tier": "high", "detail_url": "https://phishunt.io/suspicious/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e/", "image": "screenshots/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e.png", "phishunt_score": 36, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "371526b6-b9aa-479e-9549-dadbdcce3a9f", "domain": "local.comm-whatsapp.com", "registrable_domain": "comm-whatsapp.com", "url": "https://local.comm-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:47.881477+00:00", "relationship_score": 59, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/371526b6-b9aa-479e-9549-dadbdcce3a9f/", "image": "screenshots/whatsapp/371526b6-b9aa-479e-9549-dadbdcce3a9f.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR1", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "601c2be9-9e80-4fd7-81f8-5d4e349bc9e6", "domain": "local.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://local.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.389874+00:00", "relationship_score": null, "relationship_tier": null, "detail_url": "https://phishunt.io/suspicious/whatsapp/601c2be9-9e80-4fd7-81f8-5d4e349bc9e6/", "image": "screenshots/whatsapp/601c2be9-9e80-4fd7-81f8-5d4e349bc9e6.png", "phishunt_score": 37, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "caeab633-3a83-412c-8f3e-05fe4e10b9b1", "domain": "patch.comm-whatsapp.com", "registrable_domain": "comm-whatsapp.com", "url": "https://patch.comm-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:47.962362+00:00", "relationship_score": 65, "relationship_tier": "high", "detail_url": "https://phishunt.io/suspicious/whatsapp/caeab633-3a83-412c-8f3e-05fe4e10b9b1/", "image": "screenshots/whatsapp/caeab633-3a83-412c-8f3e-05fe4e10b9b1.png", "phishunt_score": 37, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR1", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "9a1d0efd-e030-4b63-ae3a-dc33581ac7ae", "domain": "patch.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://patch.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.476284+00:00", "relationship_score": 47, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/9a1d0efd-e030-4b63-ae3a-dc33581ac7ae/", "image": "screenshots/whatsapp/9a1d0efd-e030-4b63-ae3a-dc33581ac7ae.png", "phishunt_score": 37, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "6dc6f811-b49b-4246-b1f0-fcab40001c37", "domain": "photo.comm-whatsapp.com", "registrable_domain": "comm-whatsapp.com", "url": "https://photo.comm-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:48.052056+00:00", "relationship_score": 59, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/6dc6f811-b49b-4246-b1f0-fcab40001c37/", "image": "screenshots/whatsapp/6dc6f811-b49b-4246-b1f0-fcab40001c37.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR1", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "41d99970-16bb-4cbf-a991-0161e121c9c8", "domain": "photo.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://photo.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.545969+00:00", "relationship_score": null, "relationship_tier": null, "detail_url": "https://phishunt.io/suspicious/whatsapp/41d99970-16bb-4cbf-a991-0161e121c9c8/", "image": "screenshots/whatsapp/41d99970-16bb-4cbf-a991-0161e121c9c8.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "e7ad0330-8052-4ecf-929f-fbf74f140415", "domain": "premium.comm-whatsapp.com", "registrable_domain": "comm-whatsapp.com", "url": "https://premium.comm-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:48.159554+00:00", "relationship_score": 59, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/e7ad0330-8052-4ecf-929f-fbf74f140415/", "image": "screenshots/whatsapp/e7ad0330-8052-4ecf-929f-fbf74f140415.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR1", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "d7fab2e9-fbf6-47cc-9c15-1201273ea570", "domain": "premium.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://premium.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.617488+00:00", "relationship_score": null, "relationship_tier": null, "detail_url": "https://phishunt.io/suspicious/whatsapp/d7fab2e9-fbf6-47cc-9c15-1201273ea570/", "image": "screenshots/whatsapp/d7fab2e9-fbf6-47cc-9c15-1201273ea570.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "8e66aed0-3c4c-4fbf-9eb2-5c14ac20f181", "domain": "private.comm-whatsapp.com", "registrable_domain": "comm-whatsapp.com", "url": "https://private.comm-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:48.267001+00:00", "relationship_score": 65, "relationship_tier": "high", "detail_url": "https://phishunt.io/suspicious/whatsapp/8e66aed0-3c4c-4fbf-9eb2-5c14ac20f181/", "image": "screenshots/whatsapp/8e66aed0-3c4c-4fbf-9eb2-5c14ac20f181.png", "phishunt_score": 37, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR1", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "54abe7f4-6456-4956-8325-ec3ae7ceaf6e", "domain": "private.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://private.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.693394+00:00", "relationship_score": 47, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/54abe7f4-6456-4956-8325-ec3ae7ceaf6e/", "image": "screenshots/whatsapp/54abe7f4-6456-4956-8325-ec3ae7ceaf6e.png", "phishunt_score": 37, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "0dc7a062-8183-47df-97c1-7c52fa72a1c1", "domain": "sandbox.comm-whatsapp.com", "registrable_domain": "comm-whatsapp.com", "url": "https://sandbox.comm-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:48.368749+00:00", "relationship_score": 59, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/0dc7a062-8183-47df-97c1-7c52fa72a1c1/", "image": "screenshots/whatsapp/0dc7a062-8183-47df-97c1-7c52fa72a1c1.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR1", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "d5d1f9fa-0a53-4005-8b2c-b40391163043", "domain": "sandbox.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://sandbox.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.766666+00:00", "relationship_score": null, "relationship_tier": null, "detail_url": "https://phishunt.io/suspicious/whatsapp/d5d1f9fa-0a53-4005-8b2c-b40391163043/", "image": "screenshots/whatsapp/d5d1f9fa-0a53-4005-8b2c-b40391163043.png", "phishunt_score": 37, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "813c1899-6c6d-4d5a-809a-9660295af015", "domain": "staging.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://staging.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.843633+00:00", "relationship_score": null, "relationship_tier": null, "detail_url": "https://phishunt.io/suspicious/whatsapp/813c1899-6c6d-4d5a-809a-9660295af015/", "image": "screenshots/whatsapp/813c1899-6c6d-4d5a-809a-9660295af015.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "214fb6ca-6a48-4481-a184-f38b007d7703", "domain": "stream.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://stream.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:39.917168+00:00", "relationship_score": null, "relationship_tier": null, "detail_url": "https://phishunt.io/suspicious/whatsapp/214fb6ca-6a48-4481-a184-f38b007d7703/", "image": "screenshots/whatsapp/214fb6ca-6a48-4481-a184-f38b007d7703.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "1af481a3-eeb3-4da8-b724-bcc3bfe5e257", "domain": "works.comm-whatsapp.com", "registrable_domain": "comm-whatsapp.com", "url": "https://works.comm-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-04 17:24:48.664637+00:00", "relationship_score": 52, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/whatsapp/1af481a3-eeb3-4da8-b724-bcc3bfe5e257/", "image": "screenshots/whatsapp/1af481a3-eeb3-4da8-b724-bcc3bfe5e257.png", "phishunt_score": 37, "ip": "156.234.67.92", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR1", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" }, { "uuid": "929b6d52-0706-4662-98a1-48f87606f5df", "domain": "works.static-whatsapp.com", "registrable_domain": "static-whatsapp.com", "url": "https://works.static-whatsapp.com", "company": "whatsapp", "status": "active", "first_seen": "2026-09-06 05:24:40.020999+00:00", "relationship_score": null, "relationship_tier": null, "detail_url": "https://phishunt.io/suspicious/whatsapp/929b6d52-0706-4662-98a1-48f87606f5df/", "image": "screenshots/whatsapp/929b6d52-0706-4662-98a1-48f87606f5df.png", "phishunt_score": 37, "ip": "156.234.67.88", "asn": "138415", "org": "Yancy Limited", "country": "Hong Kong", "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "cert": "YR2", "gsb_category": "SOCIAL_ENGINEERING", "malicious_google": "1", "malicious_openphish": "0", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "" } ], "domains": [ { "domain": "comm-whatsapp.com", "host_count": 8, "active_count": 8, "hosts": [ "build.comm-whatsapp.com", "local.comm-whatsapp.com", "patch.comm-whatsapp.com", "photo.comm-whatsapp.com", "premium.comm-whatsapp.com", "private.comm-whatsapp.com", "sandbox.comm-whatsapp.com", "works.comm-whatsapp.com" ], "uuids": [ "a89411a2-c065-4c3c-b4df-f458b7f3cbc3", "371526b6-b9aa-479e-9549-dadbdcce3a9f", "caeab633-3a83-412c-8f3e-05fe4e10b9b1", "6dc6f811-b49b-4246-b1f0-fcab40001c37", "e7ad0330-8052-4ecf-929f-fbf74f140415", "8e66aed0-3c4c-4fbf-9eb2-5c14ac20f181", "0dc7a062-8183-47df-97c1-7c52fa72a1c1", "1af481a3-eeb3-4da8-b724-bcc3bfe5e257" ] }, { "domain": "scan-whatsapp.com", "host_count": 3, "active_count": 3, "hosts": [ "calendar.scan-whatsapp.com", "desktop.scan-whatsapp.com", "docs.scan-whatsapp.com" ], "uuids": [ "a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1", "4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9", "3c79f56e-36ac-44b1-9a9a-40562b9a773e" ] }, { "domain": "static-whatsapp.com", "host_count": 10, "active_count": 10, "hosts": [ "build.static-whatsapp.com", "local.static-whatsapp.com", "patch.static-whatsapp.com", "photo.static-whatsapp.com", "premium.static-whatsapp.com", "private.static-whatsapp.com", "sandbox.static-whatsapp.com", "staging.static-whatsapp.com", "stream.static-whatsapp.com", "works.static-whatsapp.com" ], "uuids": [ "6051c37f-811b-4687-940e-2218c656b510", "601c2be9-9e80-4fd7-81f8-5d4e349bc9e6", "9a1d0efd-e030-4b63-ae3a-dc33581ac7ae", "41d99970-16bb-4cbf-a991-0161e121c9c8", "d7fab2e9-fbf6-47cc-9c15-1201273ea570", "54abe7f4-6456-4956-8325-ec3ae7ceaf6e", "d5d1f9fa-0a53-4005-8b2c-b40391163043", "813c1899-6c6d-4d5a-809a-9660295af015", "214fb6ca-6a48-4481-a184-f38b007d7703", "929b6d52-0706-4662-98a1-48f87606f5df" ] } ], "relationships": [ { "domain_a": "build.comm-whatsapp.com", "domain_b": "calendar.scan-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a89411a2-c065-4c3c-b4df-f458b7f3cbc3/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1/", "score": 65, "tier": "high", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 17.3, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 6.9, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 5.8, "idf_factor": 0.5, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "build.comm-whatsapp.com", "domain_b": "docs.scan-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a89411a2-c065-4c3c-b4df-f458b7f3cbc3/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e/", "score": 65, "tier": "high", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 17.3, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 6.9, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 5.8, "idf_factor": 0.5, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "calendar.scan-whatsapp.com", "domain_b": "patch.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/caeab633-3a83-412c-8f3e-05fe4e10b9b1/", "score": 65, "tier": "high", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 17.3, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 6.9, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 5.8, "idf_factor": 0.5, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "calendar.scan-whatsapp.com", "domain_b": "private.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/8e66aed0-3c4c-4fbf-9eb2-5c14ac20f181/", "score": 65, "tier": "high", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 17.3, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 6.9, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 5.8, "idf_factor": 0.5, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "docs.scan-whatsapp.com", "domain_b": "patch.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/caeab633-3a83-412c-8f3e-05fe4e10b9b1/", "score": 65, "tier": "high", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 17.3, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 6.9, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 5.8, "idf_factor": 0.5, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "docs.scan-whatsapp.com", "domain_b": "private.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/8e66aed0-3c4c-4fbf-9eb2-5c14ac20f181/", "score": 65, "tier": "high", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 17.3, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 6.9, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 5.8, "idf_factor": 0.5, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "desktop.scan-whatsapp.com", "domain_b": "local.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/371526b6-b9aa-479e-9549-dadbdcce3a9f/", "score": 59, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 11.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "desktop.scan-whatsapp.com", "domain_b": "photo.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/6dc6f811-b49b-4246-b1f0-fcab40001c37/", "score": 59, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 11.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "desktop.scan-whatsapp.com", "domain_b": "premium.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/e7ad0330-8052-4ecf-929f-fbf74f140415/", "score": 59, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 11.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "desktop.scan-whatsapp.com", "domain_b": "sandbox.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/0dc7a062-8183-47df-97c1-7c52fa72a1c1/", "score": 59, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 11.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "desktop.scan-whatsapp.com", "domain_b": "works.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/1af481a3-eeb3-4da8-b724-bcc3bfe5e257/", "score": 52, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 11.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "build.comm-whatsapp.com", "domain_b": "desktop.scan-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a89411a2-c065-4c3c-b4df-f458b7f3cbc3/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "calendar.scan-whatsapp.com", "domain_b": "local.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/371526b6-b9aa-479e-9549-dadbdcce3a9f/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "calendar.scan-whatsapp.com", "domain_b": "photo.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/6dc6f811-b49b-4246-b1f0-fcab40001c37/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "calendar.scan-whatsapp.com", "domain_b": "premium.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/e7ad0330-8052-4ecf-929f-fbf74f140415/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "calendar.scan-whatsapp.com", "domain_b": "sandbox.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/a3a20b82-0c24-4d47-bb2b-c97ef6ec10b1/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/0dc7a062-8183-47df-97c1-7c52fa72a1c1/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "desktop.scan-whatsapp.com", "domain_b": "patch.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/caeab633-3a83-412c-8f3e-05fe4e10b9b1/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "desktop.scan-whatsapp.com", "domain_b": "private.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/4eaa3c2b-ef3b-4f30-8b3a-28eb976a23e9/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/8e66aed0-3c4c-4fbf-9eb2-5c14ac20f181/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "docs.scan-whatsapp.com", "domain_b": "local.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/371526b6-b9aa-479e-9549-dadbdcce3a9f/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "docs.scan-whatsapp.com", "domain_b": "photo.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/6dc6f811-b49b-4246-b1f0-fcab40001c37/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "docs.scan-whatsapp.com", "domain_b": "premium.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/e7ad0330-8052-4ecf-929f-fbf74f140415/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "docs.scan-whatsapp.com", "domain_b": "sandbox.comm-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/3c79f56e-36ac-44b1-9a9a-40562b9a773e/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/0dc7a062-8183-47df-97c1-7c52fa72a1c1/", "score": 48, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-05", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 8.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "same favicon", "signal": "favicon_phash_exact", "category": "visual", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "similar text", "signal": "ocr_similarity_full", "category": "content", "contributed": 6.0, "idf_factor": null, "dampened_by": "screenshot_phash" }, { "label": "same redirect target", "signal": "shared_final_host", "category": "infra", "contributed": 6.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "patch.comm-whatsapp.com", "domain_b": "patch.static-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/caeab633-3a83-412c-8f3e-05fe4e10b9b1/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/9a1d0efd-e030-4b63-ae3a-dc33581ac7ae/", "score": 47, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-06", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 17.6, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 10.0, "idf_factor": 1.0, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [] }, { "domain_a": "private.comm-whatsapp.com", "domain_b": "private.static-whatsapp.com", "detail_url_a": "https://phishunt.io/suspicious/whatsapp/8e66aed0-3c4c-4fbf-9eb2-5c14ac20f181/", "detail_url_b": "https://phishunt.io/suspicious/whatsapp/54abe7f4-6456-4956-8325-ec3ae7ceaf6e/", "score": 47, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-09-06", "evidence": [ { "label": "same IP", "signal": "same_ip", "category": "infra", "contributed": 17.6, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 10.0, "idf_factor": 1.0, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 7.0, "idf_factor": 0.5, "dampened_by": null }, { "label": "registered together", "signal": "domain_age_window", "category": "registration", "contributed": 5, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "certs issued together", "signal": "cert_age_window", "category": "tls", "contributed": 3, "idf_factor": null, "dampened_by": null } ], "discounted": [] } ], "relationships_truncated": false, "state": "live" }