Campaigns

Possible campaign 0a89fb41d92cACTIVE

BetaShared-infrastructure grouping of public detections. Not an attribution claim.

Indicators
16
Active
16
Brands
1
First seen
Sep 04, 2026
Most recent detection
Sep 04, 2026
What these pages look like
Screenshot of build.comm-whatsapp.com build.comm-whatsapp.com Screenshot of calendar.scan-whatsapp.com calendar.scan-whatsapp.com Screenshot of desktop.scan-whatsapp.com desktop.scan-whatsapp.com Screenshot of docs.scan-whatsapp.com docs.scan-whatsapp.com Screenshot of job.scan-whatsapp.com job.scan-whatsapp.com Screenshot of local.comm-whatsapp.com local.comm-whatsapp.com Screenshot of meet.scan-whatsapp.com meet.scan-whatsapp.com Screenshot of patch.comm-whatsapp.com patch.comm-whatsapp.com Screenshot of photo.comm-whatsapp.com photo.comm-whatsapp.com Screenshot of premium.comm-whatsapp.com premium.comm-whatsapp.com Screenshot of private.comm-whatsapp.com private.comm-whatsapp.com Screenshot of sandbox.comm-whatsapp.com sandbox.comm-whatsapp.com Screenshot of staging.comm-whatsapp.com staging.comm-whatsapp.com Screenshot of stream.comm-whatsapp.com stream.comm-whatsapp.com Screenshot of works.comm-whatsapp.com works.comm-whatsapp.com Screenshot of asset.static-whatsapp.com asset.static-whatsapp.com
Indicators
Screenshot Domain Brand Score Sources Match Status First seen
Screenshot of build.comm-whatsapp.com 1Hong Kongbuild.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of calendar.scan-whatsapp.com 2Hong Kongcalendar.scan-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of desktop.scan-whatsapp.com 3Hong Kongdesktop.scan-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of docs.scan-whatsapp.com 4Hong Kongdocs.scan-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of job.scan-whatsapp.com 5Hong Kongjob.scan-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of local.comm-whatsapp.com 6Hong Konglocal.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of meet.scan-whatsapp.com 7Hong Kongmeet.scan-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of patch.comm-whatsapp.com 8Hong Kongpatch.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of photo.comm-whatsapp.com 9Hong Kongphoto.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of premium.comm-whatsapp.com 10Hong Kongpremium.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of private.comm-whatsapp.com 11Hong Kongprivate.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of sandbox.comm-whatsapp.com 12Hong Kongsandbox.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of staging.comm-whatsapp.com 13Hong Kongstaging.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of stream.comm-whatsapp.com 14Hong Kongstream.comm-whatsapp.com WhatsApp 03737 GSB 09191 ACTIVE 2026-09-04
Screenshot of works.comm-whatsapp.com 15Hong Kongworks.comm-whatsapp.com WhatsApp 03737 GSB 08484 ACTIVE 2026-09-04
Screenshot of asset.static-whatsapp.com 16Hong Kongasset.static-whatsapp.com WhatsApp 03333 GSB 05252 ACTIVE 2026-09-04
Why this confidence
82% possible campaign
Link strength 67%
Evidence diversity 100%
Time compactness 100%
Strong-link share 70%
Size discount 100%

confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.

Evidence summary
16/16 same redirect target consent.yahoo.com
16/16 registered together 4d/4d
16/16 same registrar Guizhou Zhongyu Zhike Network Technology Co., Ltd.
16/16 certs issued together 4d/4d
15/16 same screenshot 9e516136654e3567~9e516136654e3567 d=0
Brands targeted
WhatsApp (16)
Timeline (first seen)
Sep 04 16
History
2026-09-05 created first tracked with 16 indicators

Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.

Strongest links
91 build.comm-whatsapp.com ↔ patch.comm-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 build.comm-whatsapp.com ↔ private.comm-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 build.comm-whatsapp.com ↔ staging.comm-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 calendar.scan-whatsapp.com ↔ docs.scan-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 calendar.scan-whatsapp.com ↔ meet.scan-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 desktop.scan-whatsapp.com ↔ job.scan-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 docs.scan-whatsapp.com ↔ meet.scan-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 local.comm-whatsapp.com ↔ photo.comm-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 local.comm-whatsapp.com ↔ premium.comm-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
91 local.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com similar text, same IP, same nameservers, same redirect target, similar name, registered together, same registrar, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
Supplemental links

Linked below the clustering threshold or by same-kit similarity - did not form this cluster.

42 asset.static-whatsapp.com ↔ works.comm-whatsapp.com same IP, same redirect target, registered together, same registrar, appeared together (24h), certs issued together
39 asset.static-whatsapp.com ↔ build.comm-whatsapp.com same ASN, same redirect target, registered together, same registrar, appeared together (24h), certs issued together, similar colors, same favicon
39 asset.static-whatsapp.com ↔ calendar.scan-whatsapp.com same ASN, same redirect target, registered together, same registrar, appeared together (24h), certs issued together, similar colors, same favicon
39 asset.static-whatsapp.com ↔ docs.scan-whatsapp.com same ASN, same redirect target, registered together, same registrar, appeared together (24h), certs issued together, similar colors, same favicon
39 asset.static-whatsapp.com ↔ meet.scan-whatsapp.com same ASN, same redirect target, registered together, same registrar, appeared together (24h), certs issued together, similar colors, same favicon
39 asset.static-whatsapp.com ↔ patch.comm-whatsapp.com same ASN, same redirect target, registered together, same registrar, appeared together (24h), certs issued together, similar colors, same favicon
39 asset.static-whatsapp.com ↔ private.comm-whatsapp.com same ASN, same redirect target, registered together, same registrar, appeared together (24h), certs issued together, similar colors, same favicon
39 asset.static-whatsapp.com ↔ staging.comm-whatsapp.com same ASN, same redirect target, registered together, same registrar, appeared together (24h), certs issued together, similar colors, same favicon
Relationships

Showing the 50 strongest of 112.

build.comm-whatsapp.com ↔ patch.comm-whatsapp.com 91 first reproduced 2026-09-05
build.comm-whatsapp.com patch.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
build.comm-whatsapp.com ↔ private.comm-whatsapp.com 91 first reproduced 2026-09-05
build.comm-whatsapp.com private.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
build.comm-whatsapp.com ↔ staging.comm-whatsapp.com 91 first reproduced 2026-09-05
build.comm-whatsapp.com staging.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
calendar.scan-whatsapp.com ↔ docs.scan-whatsapp.com 91 first reproduced 2026-09-05
calendar.scan-whatsapp.com docs.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
calendar.scan-whatsapp.com ↔ meet.scan-whatsapp.com 91 first reproduced 2026-09-05
calendar.scan-whatsapp.com meet.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
desktop.scan-whatsapp.com ↔ job.scan-whatsapp.com 91 first reproduced 2026-09-05
desktop.scan-whatsapp.com job.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
docs.scan-whatsapp.com ↔ meet.scan-whatsapp.com 91 first reproduced 2026-09-05
docs.scan-whatsapp.com meet.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
local.comm-whatsapp.com ↔ photo.comm-whatsapp.com 91 first reproduced 2026-09-05
local.comm-whatsapp.com photo.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
local.comm-whatsapp.com ↔ premium.comm-whatsapp.com 91 first reproduced 2026-09-05
local.comm-whatsapp.com premium.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
local.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com 91 first reproduced 2026-09-05
local.comm-whatsapp.com sandbox.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
local.comm-whatsapp.com ↔ stream.comm-whatsapp.com 91 first reproduced 2026-09-05
local.comm-whatsapp.com stream.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
patch.comm-whatsapp.com ↔ private.comm-whatsapp.com 91 first reproduced 2026-09-05
patch.comm-whatsapp.com private.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
patch.comm-whatsapp.com ↔ staging.comm-whatsapp.com 91 first reproduced 2026-09-05
patch.comm-whatsapp.com staging.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
photo.comm-whatsapp.com ↔ premium.comm-whatsapp.com 91 first reproduced 2026-09-05
photo.comm-whatsapp.com premium.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
photo.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com 91 first reproduced 2026-09-05
photo.comm-whatsapp.com sandbox.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
photo.comm-whatsapp.com ↔ stream.comm-whatsapp.com 91 first reproduced 2026-09-05
photo.comm-whatsapp.com stream.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
premium.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com 91 first reproduced 2026-09-05
premium.comm-whatsapp.com sandbox.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
premium.comm-whatsapp.com ↔ stream.comm-whatsapp.com 91 first reproduced 2026-09-05
premium.comm-whatsapp.com stream.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
private.comm-whatsapp.com ↔ staging.comm-whatsapp.com 91 first reproduced 2026-09-05
private.comm-whatsapp.com staging.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
sandbox.comm-whatsapp.com ↔ stream.comm-whatsapp.com 91 first reproduced 2026-09-05
sandbox.comm-whatsapp.com stream.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same favicon visual 7.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
local.comm-whatsapp.com ↔ works.comm-whatsapp.com 84 first reproduced 2026-09-05
local.comm-whatsapp.com works.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
photo.comm-whatsapp.com ↔ works.comm-whatsapp.com 84 first reproduced 2026-09-05
photo.comm-whatsapp.com works.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
premium.comm-whatsapp.com ↔ works.comm-whatsapp.com 84 first reproduced 2026-09-05
premium.comm-whatsapp.com works.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
sandbox.comm-whatsapp.com ↔ works.comm-whatsapp.com 84 first reproduced 2026-09-05
sandbox.comm-whatsapp.com works.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
stream.comm-whatsapp.com ↔ works.comm-whatsapp.com 84 first reproduced 2026-09-05
stream.comm-whatsapp.com works.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same IP infra 17.3 ×0.80
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 6.9 ×0.50
similar text content 6.0 - screenshot_phash
appeared together (24h) temporal 6 -
same redirect target infra 5.8 ×0.50
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same ASN infra 0.0 - same_ip
same hosting org infra 0.0 - same_ip
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
build.comm-whatsapp.com ↔ local.comm-whatsapp.com 79 first reproduced 2026-09-05
build.comm-whatsapp.com local.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
build.comm-whatsapp.com ↔ photo.comm-whatsapp.com 79 first reproduced 2026-09-05
build.comm-whatsapp.com photo.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
build.comm-whatsapp.com ↔ premium.comm-whatsapp.com 79 first reproduced 2026-09-05
build.comm-whatsapp.com premium.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
build.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com 79 first reproduced 2026-09-05
build.comm-whatsapp.com sandbox.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
build.comm-whatsapp.com ↔ stream.comm-whatsapp.com 79 first reproduced 2026-09-05
build.comm-whatsapp.com stream.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
calendar.scan-whatsapp.com ↔ desktop.scan-whatsapp.com 79 first reproduced 2026-09-05
calendar.scan-whatsapp.com desktop.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
calendar.scan-whatsapp.com ↔ job.scan-whatsapp.com 79 first reproduced 2026-09-05
calendar.scan-whatsapp.com job.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
desktop.scan-whatsapp.com ↔ docs.scan-whatsapp.com 79 first reproduced 2026-09-05
desktop.scan-whatsapp.com docs.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
desktop.scan-whatsapp.com ↔ meet.scan-whatsapp.com 79 first reproduced 2026-09-05
desktop.scan-whatsapp.com meet.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
docs.scan-whatsapp.com ↔ job.scan-whatsapp.com 79 first reproduced 2026-09-05
docs.scan-whatsapp.com job.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
job.scan-whatsapp.com ↔ meet.scan-whatsapp.com 79 first reproduced 2026-09-05
job.scan-whatsapp.com meet.scan-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
local.comm-whatsapp.com ↔ patch.comm-whatsapp.com 79 first reproduced 2026-09-05
local.comm-whatsapp.com patch.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
local.comm-whatsapp.com ↔ private.comm-whatsapp.com 79 first reproduced 2026-09-05
local.comm-whatsapp.com private.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
local.comm-whatsapp.com ↔ staging.comm-whatsapp.com 79 first reproduced 2026-09-05
local.comm-whatsapp.com staging.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
patch.comm-whatsapp.com ↔ photo.comm-whatsapp.com 79 first reproduced 2026-09-05
patch.comm-whatsapp.com photo.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
patch.comm-whatsapp.com ↔ premium.comm-whatsapp.com 79 first reproduced 2026-09-05
patch.comm-whatsapp.com premium.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
patch.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com 79 first reproduced 2026-09-05
patch.comm-whatsapp.com sandbox.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
patch.comm-whatsapp.com ↔ stream.comm-whatsapp.com 79 first reproduced 2026-09-05
patch.comm-whatsapp.com stream.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
photo.comm-whatsapp.com ↔ private.comm-whatsapp.com 79 first reproduced 2026-09-05
photo.comm-whatsapp.com private.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
photo.comm-whatsapp.com ↔ staging.comm-whatsapp.com 79 first reproduced 2026-09-05
photo.comm-whatsapp.com staging.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
premium.comm-whatsapp.com ↔ private.comm-whatsapp.com 79 first reproduced 2026-09-05
premium.comm-whatsapp.com private.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
premium.comm-whatsapp.com ↔ staging.comm-whatsapp.com 79 first reproduced 2026-09-05
premium.comm-whatsapp.com staging.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
private.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com 79 first reproduced 2026-09-05
private.comm-whatsapp.com sandbox.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
private.comm-whatsapp.com ↔ stream.comm-whatsapp.com 79 first reproduced 2026-09-05
private.comm-whatsapp.com stream.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
sandbox.comm-whatsapp.com ↔ staging.comm-whatsapp.com 79 first reproduced 2026-09-05
sandbox.comm-whatsapp.com staging.comm-whatsapp.com
SignalCategoryContributedIDFNotes
same TLS cert tls 14.4 ×0.80
similar name naming 8.0 ×0.80
same screenshot visual 8.0 ×0.50
same nameservers infra 7.0 ×0.50
same favicon visual 7.0 ×0.50
similar text content 6.0 - screenshot_phash
same redirect target infra 6.0 ×0.50
appeared together (24h) temporal 6 -
same ASN infra 5 -
registered together registration 5 -
same registrar registration 4 -
certs issued together tls 3 -

Discounted observations

same hosting org infra 0.0 - same_asn
shared TLS SAN tls 0.0 ×0.80 cert_fingerprint_exact
similar colors visual 0.0 - screenshot_phash
Infrastructure footprint
IP addresses
156.234.67.92 9/16
156.234.67.88 7/16
ASNs
138415 16/16
Hosting orgs
Yancy Limited 16/16
Registrars
Guizhou Zhongyu Zhike Network Technology Co., Ltd. 16/16
TLS certs
YR1 10/16
YR2 6/16
Export JSON CSV TXT
corr-1.2.0 · built 2026-09-05 05:00 UTC - rebuilt daily