Keamanan domain dan intelijen ancaman

meta.webweb1-whatsapp.com

Name: meta.webweb1-whatsapp.com — PhishDestroy evidence record
Published: 2026-10-23
License: https://creativecommons.org/licenses/by/4.0/

Ringkasnya

meta.webweb1-whatsapp.com: Peniruan WhatsApp, terdeteksi oleh PhishDestroy pada 2026-10-23.

“Preparing Secure Connection...”

Tinjau bukti

Registrar: Guizhou Zhongyu Zhike …
Alamat IP: 104.21.92.251Cloudflare, Inc. · CDN
Terdaftar: 28/09/2026
Pertama kali teramati: 23/10/2026

Penilaian PhishDestroy Kritis

95/100

Skor bukti

Ketersediaan Terakhir diketahui aktif Pengamatan keterjangkauan tersimpan terbaru Teramati 28 Okt 2026 · 00:12 UTCPemeriksaan HTTP

Sinyal risiko

Deteksi Total Virus: 8/92 Spamhaus DBL: domain phishing Daftar blokir yang disimpan cocok: 2 Label merek otomatis: WhatsApp Jenis penipuan: Peniruan Domain muda: 29 berumur hari

VirusTotal

8 / 92

deteksi mesin · 2026-10-23

Pertandingan dalam daftar blokir

MetaMask, SEAL

Tangkapan halaman

buka galeri

Usia domain

29 hari

Laporan terkirim

lihat lini masa

ABUSE NOTICE · 72H+ OPEN Laporan penyalahgunaan yang dikirim dicatat; bukti ketersediaan terbaru yang tersimpan masih menunjukkan bahwa domain tersebut dapat diakses.

Pemberitahuan dan bukti status terkini

Buku catatan laporan yang dikirim mencatat laporan keluar pertama pada 2026-10-23 03:40:03 UTC. The recorded recipient is abuse3814@brandfocus.cn. Bukti ketersediaan yang tersimpan terbaru masih menunjukkan bahwa domain tersebut dapat diakses; 4 days telah berlalu sejak laporan pertama yang dikirimkan.

ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.

Waktu yang telah berlalu sejak laporan pertama

4 days

Laporan terkirim

ID kasus terbaru

PD-20261023-31677B

Status saat ini

HTTP 200 pemeriksaan terakhir yang tersimpan

Ringkasan laporan

Peniruan WhatsApp: meta.webweb1-whatsapp.com — Terakhir diketahui aktif (HTTP 200). Ringkasan bukti: VirusTotal 8/92 (alphaMountain.ai, BitDefender, CRDF…

Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.

Analisis

Ringkasan domain

meta.webweb1-whatsapp.com: Peniruan WhatsApp, terdeteksi oleh PhishDestroy pada 2026-10-23. Risiko: kritis (95/100). Registrar: Guizhou Zhongyu Zhike …. Status: Terakhir diketahui aktif. Hosting: Cloudflare, Inc. PhishDestroy mengirim 1 laporan penyalahgunaan. VirusTotal: 8/92 mesin menandainya. Tercantum di Spamhaus DBL. Jangan masukkan kredensial dan jangan hubungkan dompet.

Kritis

Status: Terakhir diketahui aktif
VirusTotal: 8 / 92
Pertandingan dalam daftar blokir: 2
Jenis penipuan: Peniruan
Layanan Hosting: 104.21.92.251Cloudflare, Inc. · CDN
Registrar: Guizhou Zhongyu Zhike …
Terdaftar: 28/09/2026
Tangkapan halaman: 10

Tangkapan halaman Hasil sumber Catatan pendaftaran

Laporan Ancaman PhishDestroy2026-10-26 22:35:37 UTC

Overview

The captured screenshot from 2026-10-23 shows a dark interstitial reading "Checking your browser source..." and "Please wait a moment while we secure your connection." The captured page title was WhatsApp Web, recorded on 2026-10-23. PhishDestroy classified the domain as an impersonation phishing page and first saw it on 2026-10-23.

How the scam works

The page acts as a staging interstitial: it asks visitors to wait while a connection is prepared, after which a client-side redirect sends them to the impersonated brand's genuine service, as recorded in the observed redirect chain. This funnel pattern lets an unrelated lookalike hostname borrow the trust of a well-known messaging brand. As a category risk, such redirectors route recipients from lures through an attacker-chosen domain before handing them off, obscuring where the traffic originated.

Bukti

The screenshot shows only the wait message, with no login form visible at capture time. urlscan recorded a final-state verdict that was not malicious with an ML engine score of -99, and Google Safe Browsing did not flag the domain when checked on 2026-10-26. VirusTotal flagged the domain as phishing, with BitDefender and Fortinet among the labelling vendors, while Spamhaus listed it in the phishing category on 2026-10-23. MetaMask, SEAL and PhishDestroy blocklists carried the domain, OTX returned 0 pulses on 2026-10-23, and urlscan globals showed Meta-style loader globals including requireLazy and banzai alongside a lit-html and lit-element stack with 1 tracker request.

Infrastruktur

Notable weaknesses lead: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP are all absent; DNSSEC is unsigned. DNS uses Cloudflare nameservers with a Cloudflare WAF and CDN in front. TLS 1.3, TLS-AES-256-GCM-SHA384, forward secrecy, ALPN h2; CAA record present; no mail authentication data recorded. No registrar data was recorded for meta.webweb1-whatsapp.com.

What to do

If you opened this domain and entered a WhatsApp password, change that password on the genuine service and enable two-factor authentication, and review recent linked sessions for anything unexpected. For defenders, block meta.webweb1-whatsapp.com at the DNS or proxy layer, hunt for visits to it in logs, and report it to hosting and browser vendors for review.

Bukti sumberVirusTotal 8 / 92 9 sumber

VirusTotal

8 / 92 deteksi mesin · ringkasan yang tersimpan

2026-10-23 02:40 UTC

Buka laporan

VirusTotalCatatan asli sumberTeramati: 2026-10-22 16:10:06 UTC14 kolom

Teramati: 2026-10-22T16:10:06Z · Diambil: 2026-10-23T02:40:04Z

Jumlah hasil vendor

Waktu habis: 0
Tidak berbahaya: 49
Berbahaya: 6
Mencurigakan: 2
Tidak terdeteksi: 35

Label pemasok

CRDF: malicious
ESET: suspicious
VIPRE: phishing
G-Data: phishing
Webroot: malicious
Fortinet: phishing
BitDefender: phishing
alphaMountain.ai: spam

Skor reputasi

Registrar

Guizhou Zhongyu Zhike Network Technology Co., Ltd.

Dibuat

2026-09-28 11:39:03 UTC

Berlaku hingga

2027-09-28 11:39:03 UTC

Diperbarui

2026-09-28 11:56:26 UTC

Pertama terlihat

2026-09-29 05:34:49 UTC

Catatan DNS

TTL, detik
300
Jenis
A
Nilai
172.67.201.182
TTL, detik
300
Jenis
AAAA
Nilai
2606:4700:3030::6815:5cfb
TTL, detik
300
Jenis
AAAA
Nilai
2606:4700:3033::ac43:c9b6
TTL, detik
300
Jenis
A
Nilai
104.21.92.251

Waktu pengambilan catatan DNS

2026-10-22 16:44:34 UTC

Sidik jari JARM

27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c

Sertifikat

Nama alternatif subjek (SAN): *.webweb1-whatsapp.com
webweb1-whatsapp.com
Penerbit: Let's Encrypt / YE2
Nomor seri: 5cf0c59bd7b8ae78de402b98ee1439b1a6
SHA-256: c51bc54df6d7dd6ce04f4c9c484296ca4ad79030292b748f678b8d780408f4dc
Subjek: webweb1-whatsapp.com
Berlaku hingga: 2026-12-27 11:02:22 UTC
Berlaku sejak: 2026-09-28 11:02:23 UTC

Catatan pendaftaran

Registrar: Guizhou Zhongyu Zhike Network Technology Co., Ltd.
ID IANA registrar: 3814
URL registrar: http://www.zuuq.cn
Terdaftar: 2026-09-28 11:39:03 UTC
Diperbarui: 2026-09-28 11:56:26 UTC
Berlaku hingga: 2027-09-28 11:39:03 UTC
Status: ok
Server nama: isaac.ns.cloudflare.com
love.ns.cloudflare.com
DNSSEC: unsigned

Kolom asli sumber · JSON

Jumlah hasil vendor	{ "timeout": 0, "harmless": 49, "malicious": 6, "suspicious": 2, "undetected": 35 }
Label pemasok	{ "CRDF": "malicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "spam" }
Reputasi	0
Tag	[ "dga" ]
Registrar	Guizhou Zhongyu Zhike Network Technology Co., Ltd.
Dibuat	2026-09-28T11:39:03Z
Berlaku hingga	2027-09-28T11:39:03Z
Diperbarui	2026-09-28T11:56:26Z
Pertama terlihat	2026-09-29T05:34:49Z
Catatan DNS	[ { "ttl": 300, "type": "A", "value": "172.67.201.182" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:5cfb" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:c9b6" }, { "ttl": 300, "type": "A", "value": "104.21.92.251" } ]
Dns at	2026-10-22T16:44:34Z
Jarm	27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c
Sertifikat	{ "san": [ "*.webweb1-whatsapp.com", "webweb1-whatsapp.com" ], "issuer": "Let's Encrypt / YE2", "serial": "5cf0c59bd7b8ae78de402b98ee1439b1a6", "sha256": "c51bc54df6d7dd6ce04f4c9c484296ca4ad79030292b748f678b8d780408f4dc", "subject": "webweb1-whatsapp.com", "valid_to": "2026-12-27T11:02:22Z", "valid_from": "2026-09-28T11:02:23Z" }
Catatan pendaftaran	{ "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "registrar_iana_id": "3814", "registrar_url": "http://www.zuuq.cn", "created": "2026-09-28T11:39:03Z", "updated": "2026-09-28T11:56:26Z", "expires": "2027-09-28T11:39:03Z", "status": [ "ok" ], "nameservers": [ "isaac.ns.cloudflare.com", "love.ns.cloudflare.com" ], "dnssec": "unsigned" }

Catatan sumber terpisah · 6 malicious + 2 suspicious / 92 · 2026-10-22 16:10:06 UTC

Ringkasan di atas dan catatan penyedia ini dikumpulkan pada waktu yang berbeda. Keduanya tetap tersedia; klasifikasi berbahaya dan mencurigakan ditampilkan secara terpisah.

record_source: collected_observations.vt
analysis_at: 2026-10-22T16:10:06Z
fetched_at: 2026-10-23T02:40:04Z
stats: {"timeout":0,"harmless":49,"malicious":6,"suspicious":2,"undetected":35}

Spamhaus DBL

domain phishing

2026-10-23 02:31 UTC

URLQuery

Laporan pemindaian

Buka laporan

OTX

tidak ada referensi komunitas

2026-10-23 02:41 UTC

Buka laporan

Cloudflare Radar

provider verdict: clean

Buka laporan

Cloudflare RadarCatatan asli sumberTeramati: 2026-10-23 02:03:19 UTC11 kolom

Teramati: 2026-10-23T02:03:19Z · Diambil: 2026-10-23T02:09:39Z

ID laporan

b7911641-f1d6-4c5e-85dc-22320f13d99e

URL Akhir

https://web.whatsapp.com/

Respons HTTP

200

Riwayat navigasi

URL
https://meta.webweb1-whatsapp.com/
Status
200
URL
https://web.whatsapp.com/
Status
200

Hash struktur DOM

8287c458b2bb17f7934d0641593108c0798175cb15ff74bd99ff30ffeb826d92

Hash dokumen

c59893b6a1141a19479d4253cb491205802d575a1b86509b43a2df130dfcc23f