Phishing detection: blp-whatsapp.com
WhatsApp Screenshot
Investigate
Domain
blp-whatsapp.com1 CT host on apex
urlscan
VirusTotal
Whois
IP
156.234.58.242
ipinfo
Greynoise
URL
http://blp-whatsapp.com
Phishunt analysis Beta
25
low suspicionheuristic risk score · not a probability
Why?
- +5.3 Keyword match
- +5.1 Site cluster
- +3.4 Shared IP cluster
- +3.2 Young domain
- +3.0 TweetFeed
- +0.9 Young certificate
- +0.9 No registrar lock
- +0.7 Brand in cert SAN
- +0.7 Brand typo
- +0.6 Final host mismatch
- +0.6 Registrar reputation
- +0.3 Free CA
- +0.3 Long domain
- +0.2 Obfuscated JavaScript
- +0.2 Suspicious TLD
- +0.1 Hyphens
- +0.1 External scripts
- +0.0 ASN reputation
22 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Typosquat domain impersonating WhatsApp, one of a batch of near-identical lookalike domains sharing one Hong Kong IP. Certificate SAN references the brand, the domain is newly registered, and the URL is flagged in TweetFeed. Likely used to harvest credentials or phone numbers.
Brand in cert SANTweetFeedShared IP cluster
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-22 · confidence 70%
Domain & Network
Whois
Registrar
GKG.Net, Inc.
Network
Country
Hong Kong
Hong Kong
Hosting
Yancy Limited
ASN
AS138415
TLS Cert
YR2
External detection
TweetFeed
CleanGoogle Safe Browsing · OpenPhish · PhishTank · urlscan.io
Campaign
Requests
Resources
Observables
Related websites
Report this phishing
Submit to blocklists