Possible campaign a566bb7e172eACTIVE
BetaShared-infrastructure grouping of public detections. Not an attribution claim.
Domains
318 hostsActive
18Brands
1First seen
Sep 04, 2026Most recent detection
Sep 07, 2026 What these pages look like
desktop.comm-whatsapp.com
desktop.sec-whatsapp.com
desktop.scan-whatsapp.com
build.comm-whatsapp.com
calendar.scan-whatsapp.com
docs.scan-whatsapp.com
local.comm-whatsapp.com
patch.comm-whatsapp.com
photo.comm-whatsapp.com
playground.sec-whatsapp.com
premium.comm-whatsapp.com
private.comm-whatsapp.com
sandbox.comm-whatsapp.com
weekly.comm-whatsapp.com
cn.comm-whatsapp.com
notify.comm-whatsapp.com
plan.comm-whatsapp.com
works.comm-whatsapp.com
Domains
| Domain | Hosts | Active |
|---|---|---|
| comm-whatsapp.com | 13 | 13 |
| scan-whatsapp.com | 3 | 3 |
| sec-whatsapp.com | 2 | 2 |
Indicators
desktop.comm-whatsapp.com Why this confidence
74%
possible campaign
Link strength
60%
Evidence diversity
100%
Time compactness
94%
Strong-link share
33%
Size discount
100%
confidence = clamp(0.45×D + 0.25×V + 0.20×T + 0.10×B, 0, 1) × S. Thresholds: 70%+ possible campaign, 40%+ suspected cluster.
Evidence summary
3/3
same screenshot
9e516136654e3567~9e516136654e3567 d=0
3/3
similar name
desktop
3/3
same favicon
e266cd9993338e92
3/3
similar text
jaccard=1.00
Brands targeted
Timeline (first seen)
Spread over 3 days
Sep 04
11
Sep 07
7
History
2026-09-08
created
first tracked with 3 members
Rebuilt daily; history is kept for 180 days. A campaign keeps its identifier as members join or leave.
Strongest links
64
desktop.comm-whatsapp.com ↔ desktop.sec-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
58
desktop.comm-whatsapp.com ↔ desktop.scan-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (72h), same favicon, same screenshot
58
desktop.scan-whatsapp.com ↔ desktop.sec-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (72h), same favicon, same screenshot
56
build.comm-whatsapp.com ↔ calendar.scan-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
56
build.comm-whatsapp.com ↔ docs.scan-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
56
calendar.scan-whatsapp.com ↔ patch.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
56
calendar.scan-whatsapp.com ↔ private.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
56
desktop.scan-whatsapp.com ↔ local.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
56
desktop.scan-whatsapp.com ↔ photo.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
56
desktop.scan-whatsapp.com ↔ premium.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, registered together, appeared together (24h), certs issued together, same favicon, same screenshot
Supplemental links
Linked below the clustering threshold or by same-kit similarity - did not form this cluster.
82
calendar.scan-whatsapp.com ↔ docs.scan-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
78
notify.comm-whatsapp.com ↔ plan.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
75
build.comm-whatsapp.com ↔ patch.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
75
build.comm-whatsapp.com ↔ private.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
75
local.comm-whatsapp.com ↔ photo.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
75
local.comm-whatsapp.com ↔ premium.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
75
local.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
75
patch.comm-whatsapp.com ↔ private.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
75
photo.comm-whatsapp.com ↔ premium.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
75
photo.comm-whatsapp.com ↔ sandbox.comm-whatsapp.com
similar text, same IP, same nameservers, same redirect target, similar name, registered together, appeared together (24h), certs issued together, same TLS cert, same favicon, same screenshot
Relationships
desktop.comm-whatsapp.com ↔ desktop.sec-whatsapp.com 64 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| similar name | naming | 8.0 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.comm-whatsapp.com ↔ desktop.scan-whatsapp.com 58 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| similar name | naming | 8.0 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ desktop.sec-whatsapp.com 58 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| similar name | naming | 8.0 | ×0.80 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
build.comm-whatsapp.com ↔ calendar.scan-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
build.comm-whatsapp.com ↔ docs.scan-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ patch.comm-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ private.comm-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.comm-whatsapp.com ↔ playground.sec-whatsapp.com 56 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ local.comm-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ photo.comm-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ premium.comm-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ sandbox.comm-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.sec-whatsapp.com ↔ weekly.comm-whatsapp.com 56 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ patch.comm-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ private.comm-whatsapp.com 56 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
playground.sec-whatsapp.com ↔ weekly.comm-whatsapp.com 56 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ cn.comm-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
cn.comm-whatsapp.com ↔ docs.scan-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ playground.sec-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.sec-whatsapp.com ↔ local.comm-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.sec-whatsapp.com ↔ photo.comm-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.sec-whatsapp.com ↔ premium.comm-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.sec-whatsapp.com ↔ sandbox.comm-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
local.comm-whatsapp.com ↔ playground.sec-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
photo.comm-whatsapp.com ↔ playground.sec-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
playground.sec-whatsapp.com ↔ premium.comm-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
playground.sec-whatsapp.com ↔ sandbox.comm-whatsapp.com 50 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| appeared together (72h) | temporal | 4 | - | |
| same nameservers | infra | 3.5 | ×0.25 |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ notify.comm-whatsapp.com 48 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| appeared together (7d) | temporal | 2 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
calendar.scan-whatsapp.com ↔ plan.comm-whatsapp.com 48 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| appeared together (7d) | temporal | 2 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ weekly.comm-whatsapp.com 48 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| appeared together (7d) | temporal | 2 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
desktop.scan-whatsapp.com ↔ works.comm-whatsapp.com 48 first reproduced 2026-09-05
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| appeared together (24h) | temporal | 6 | - | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| certs issued together | tls | 3 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ notify.comm-whatsapp.com 48 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| appeared together (7d) | temporal | 2 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
docs.scan-whatsapp.com ↔ plan.comm-whatsapp.com 48 first reproduced 2026-09-08
| Signal | Category | Contributed | IDF | Notes |
|---|---|---|---|---|
| same IP | infra | 11.0 | ×0.50 | |
| same screenshot | visual | 8.0 | ×0.50 | |
| same favicon | visual | 7.0 | ×0.50 | |
| similar text | content | 6.0 | - | screenshot_phash |
| same redirect target | infra | 6.0 | ×0.50 | |
| registered together | registration | 5 | - | |
| same nameservers | infra | 3.5 | ×0.25 | |
| appeared together (7d) | temporal | 2 | - |
Discounted observations
| similar colors | visual | 0.0 | - | screenshot_phash |
Infrastructure footprint