Phishing detection: action-whatsapp.com
WhatsApp Screenshot
Investigate
Domain
action-whatsapp.com1 CT host on apex
urlscan
VirusTotal
Whois
IP
156.234.58.242
ipinfo
Greynoise
URL
http://action-whatsapp.com
Phishunt analysis Beta
26
low suspicionheuristic risk score · not a probability
Why?
- +5.3 Keyword match
- +5.1 Site cluster
- +4.0 Young domain
- +3.4 Shared IP cluster
- +3.0 TweetFeed
- +1.1 No CSP header
- +0.9 Young certificate
- +0.9 No registrar lock
- +0.7 Brand in cert SAN
- +0.6 Registrar reputation
- +0.4 Long domain
- +0.3 Free CA
- +0.2 Suspicious TLD
- +0.1 Hyphens
- +0.0 ASN reputation
17 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Newly registered (4 days) domain combining the WhatsApp name with the word action to impersonate the brand. Serves over plain HTTP with no CSP, a brand-naming certificate, and a shared Hong Kong IP hosting many similar domains.
Brand in cert SANYoung domainTweetFeed
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-22 · confidence 65%
Domain & Network
Whois
Registrar
GKG.Net, Inc.
Network
Country
Hong Kong
Hong Kong
Hosting
Yancy Limited
ASN
AS138415
TLS Cert
YR2
External detection
TweetFeed
CleanGoogle Safe Browsing · OpenPhish · PhishTank · urlscan.io
Requests
Resources
Observables
Related websites
Report this phishing
Submit to blocklists