whatsapp-security-absurd[.]pages[.]dev

PhishDestroy identifies whatsapp-security-absurd.pages.dev as an active brand impersonation domain mimicking WhatsApp security pages to harvest user credentials and crypto wallet access. This fraudulent site lures victims with urgent security alerts, tricking them into entering login details that are immediately exfiltrated to attacker-controlled servers. Based on observed behavior, once credentials are captured, the threat actors may also probe for connected cryptocurrency wallets or payment platforms, increasing the risk of financial loss beyond simple account takeover. PhishDestroy’s analysis reveals this domain uses a valid SSL certificate issued by Let’s Encrypt and resolves to IP address 172.66.47.23, which is hosted on Cloudflare infrastructure. As of this report, VirusTotal shows zero detections (2/95 engines) — meaning most antivirus tools currently miss this threat. The domain was registered recently through Cloudflare, Inc., with a pattern consistent with fast-changing phishing infrastructure designed to evade blocklists. While the site is currently active and undergoing evaluation, its use of Cloudflare CDN and Let’s Encrypt certificates reflects an attempt to appear legitimate and bypass security filters. If you have visited whatsapp-security-absurd.pages.dev, immediately log out of all active browser sessions, change your WhatsApp password, and enable two-factor authentication. Scan your device with updated antivirus software and inspect any linked cryptocurrency wallets or payment apps for unauthorized transactions. Report the domain to your security team and block it at the network level. Avoid re-engaging with similar prompts, and verify all security alerts directly through official WhatsApp channels only.