域安全和威胁情报

meta.webweb1-whatsapp.com

Name: meta.webweb1-whatsapp.com — PhishDestroy evidence record
Published: 2026-10-23
License: https://creativecommons.org/licenses/by/4.0/

简要

meta.webweb1-whatsapp.com：冒充 WhatsApp，PhishDestroy 于 2026-10-23 检测到。风险：关键（95/100）。注册商：Guizhou Zhongyu Zhike …。状态：最后一次已知在线状态。托管：Cloudflare, Inc。PhishDestroy 已发送1 份滥用举报。VirusTotal：8/92 个引擎标记。已列入 Spamhaus DBL。请勿输入登录凭据，也不要连接钱包。

“Preparing Secure Connection...”

查看证据

注册商: Guizhou Zhongyu Zhike …
IP 地址: 104.21.92.251Cloudflare, Inc. · CDN
注册时间: 2026年9月28日
首次观测: 2026年10月23日

PhishDestroy评估关键

95/100

证据评分

可用性 最后一次已知在线状态 最新存储的可达性观察观测时间 2026年10月28日 · 00:12 UTCHTTP 探测

风险信号

病毒检测总数：8/92 Spamhaus DBL: 网络钓鱼域名存储的阻止列表匹配项：2 自动品牌标签：WhatsApp 诈骗类型：仿冒年轻域名：29 天龄

VirusTotal

8 / 92

发动机检测 · 2026-10-23

黑名单匹配项

MetaMask, SEAL

页面快照

打开图库

域名年龄

29 天

已发送举报

查看时间线

ABUSE NOTICE · 72H+ OPEN 外发滥用报告均被记录；存储的最新可用性证据仍显示该域名可访问。

通知与当前状态证据

已发送报告日志记录了首份外发报告的时间为 2026-10-23 03:40:03 UTC. The recorded recipient is abuse3814@brandfocus.cn. 最新的存储可用性证据仍显示该域名可访问; 4 days 自首份外发报告发布以来，已过去……

ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.

自首次报告以来的时间

4 days

已发送举报

分析

域名概览

关键

状态: 最后一次已知在线状态
VirusTotal: 8 / 92
黑名单匹配项: 2
诈骗类型: 仿冒
托管: 104.21.92.251Cloudflare, Inc. · CDN
注册商: Guizhou Zhongyu Zhike …
注册时间: 2026年9月28日
页面快照: 10

页面快照来源结果注册记录

PhishDestroy威胁报告2026-10-26 22:35:37 UTC

Overview

The captured screenshot from 2026-10-23 shows a dark interstitial reading "Checking your browser source..." and "Please wait a moment while we secure your connection." The captured page title was WhatsApp Web, recorded on 2026-10-23. PhishDestroy classified the domain as an impersonation phishing page and first saw it on 2026-10-23.

How the scam works

The page acts as a staging interstitial: it asks visitors to wait while a connection is prepared, after which a client-side redirect sends them to the impersonated brand's genuine service, as recorded in the observed redirect chain. This funnel pattern lets an unrelated lookalike hostname borrow the trust of a well-known messaging brand. As a category risk, such redirectors route recipients from lures through an attacker-chosen domain before handing them off, obscuring where the traffic originated.

证据

The screenshot shows only the wait message, with no login form visible at capture time. urlscan recorded a final-state verdict that was not malicious with an ML engine score of -99, and Google Safe Browsing did not flag the domain when checked on 2026-10-26. VirusTotal flagged the domain as phishing, with BitDefender and Fortinet among the labelling vendors, while Spamhaus listed it in the phishing category on 2026-10-23. MetaMask, SEAL and PhishDestroy blocklists carried the domain, OTX returned 0 pulses on 2026-10-23, and urlscan globals showed Meta-style loader globals including requireLazy and banzai alongside a lit-html and lit-element stack with 1 tracker request.

基础设施

Notable weaknesses lead: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP are all absent; DNSSEC is unsigned. DNS uses Cloudflare nameservers with a Cloudflare WAF and CDN in front. TLS 1.3, TLS-AES-256-GCM-SHA384, forward secrecy, ALPN h2; CAA record present; no mail authentication data recorded. No registrar data was recorded for meta.webweb1-whatsapp.com.

What to do

If you opened this domain and entered a WhatsApp password, change that password on the genuine service and enable two-factor authentication, and review recent linked sessions for anything unexpected. For defenders, block meta.webweb1-whatsapp.com at the DNS or proxy layer, hunt for visits to it in logs, and report it to hosting and browser vendors for review.

来源证据VirusTotal 8 / 92 9 个来源

VirusTotal

8 / 92 发动机检测 · 存储的摘要

2026-10-23 02:40 UTC

打开报告

VirusTotal来源原始记录观测时间: 2026-10-22 16:10:06 UTC14 个字段

观测时间: 2026-10-22T16:10:06Z · 检索到: 2026-10-23T02:40:04Z

供应商结果计数

超时: 0
无害: 49
恶意: 6
可疑的: 2
未检测到: 35

供应商标签

CRDF: malicious
ESET: suspicious
VIPRE: phishing
G-Data: phishing
Webroot: malicious
Fortinet: phishing
BitDefender: phishing
alphaMountain.ai: spam

信誉评分

注册商

Guizhou Zhongyu Zhike Network Technology Co., Ltd.

创建

2026-09-28 11:39:03 UTC

有效期至

2027-09-28 11:39:03 UTC

已更新

2026-09-28 11:56:26 UTC

首次发现

2026-09-29 05:34:49 UTC

DNS 记录

TTL（秒）
300
类型
A
值
172.67.201.182
TTL（秒）
300
类型
AAAA
值
2606:4700:3030::6815:5cfb
TTL（秒）
300
类型
AAAA
值
2606:4700:3033::ac43:c9b6
TTL（秒）
300
类型
A
值
104.21.92.251

DNS 记录获取时间

2026-10-22 16:44:34 UTC

JARM 指纹

27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c

证书

使用者备用名称（SAN）: *.webweb1-whatsapp.com
webweb1-whatsapp.com
签发者: Let's Encrypt / YE2
序列号: 5cf0c59bd7b8ae78de402b98ee1439b1a6
SHA-256: c51bc54df6d7dd6ce04f4c9c484296ca4ad79030292b748f678b8d780408f4dc
使用者（Subject）: webweb1-whatsapp.com
到期时间: 2026-12-27 11:02:22 UTC
生效时间: 2026-09-28 11:02:23 UTC

注册记录

注册商: Guizhou Zhongyu Zhike Network Technology Co., Ltd.
注册商 IANA ID: 3814
注册商 URL: http://www.zuuq.cn
注册时间: 2026-09-28 11:39:03 UTC
已更新: 2026-09-28 11:56:26 UTC
有效期至: 2027-09-28 11:39:03 UTC
状态: ok
域名服务器: isaac.ns.cloudflare.com
love.ns.cloudflare.com
DNSSEC: unsigned

来源原始字段 · JSON

供应商结果计数	{ "timeout": 0, "harmless": 49, "malicious": 6, "suspicious": 2, "undetected": 35 }
供应商标签	{ "CRDF": "malicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "spam" }
声誉	0
标签	[ "dga" ]
注册商	Guizhou Zhongyu Zhike Network Technology Co., Ltd.
创建	2026-09-28T11:39:03Z
有效期至	2027-09-28T11:39:03Z
已更新	2026-09-28T11:56:26Z
首次发现	2026-09-29T05:34:49Z
DNS 记录	[ { "ttl": 300, "type": "A", "value": "172.67.201.182" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:5cfb" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:c9b6" }, { "ttl": 300, "type": "A", "value": "104.21.92.251" } ]
Dns at	2026-10-22T16:44:34Z
Jarm	27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c
证书	{ "san": [ "*.webweb1-whatsapp.com", "webweb1-whatsapp.com" ], "issuer": "Let's Encrypt / YE2", "serial": "5cf0c59bd7b8ae78de402b98ee1439b1a6", "sha256": "c51bc54df6d7dd6ce04f4c9c484296ca4ad79030292b748f678b8d780408f4dc", "subject": "webweb1-whatsapp.com", "valid_to": "2026-12-27T11:02:22Z", "valid_from": "2026-09-28T11:02:23Z" }
注册记录	{ "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.", "registrar_iana_id": "3814", "registrar_url": "http://www.zuuq.cn", "created": "2026-09-28T11:39:03Z", "updated": "2026-09-28T11:56:26Z", "expires": "2027-09-28T11:39:03Z", "status": [ "ok" ], "nameservers": [ "isaac.ns.cloudflare.com", "love.ns.cloudflare.com" ], "dnssec": "unsigned" }

单独的源记录 · 6 malicious + 2 suspicious / 92 · 2026-10-22 16:10:06 UTC

上述摘要和此服务提供商记录是在不同时间收集的。两者均仍可查阅；恶意和可疑的分类结果分别显示。

record_source: collected_observations.vt
analysis_at: 2026-10-22T16:10:06Z
fetched_at: 2026-10-23T02:40:04Z
stats: {"timeout":0,"harmless":49,"malicious":6,"suspicious":2,"undetected":35}

Spamhaus DBL

网络钓鱼域名

2026-10-23 02:31 UTC

URLQuery

扫描报告

打开报告

OTX

无社区引用

2026-10-23 02:41 UTC

打开报告

Cloudflare Radar

provider verdict: clean

打开报告

Cloudflare Radar来源原始记录观测时间: 2026-10-23 02:03:19 UTC11 个字段

观测时间: 2026-10-23T02:03:19Z · 检索到: 2026-10-23T02:09:39Z

报告 ID

b7911641-f1d6-4c5e-85dc-22320f13d99e

最终 URL

https://web.whatsapp.com/

HTTP 响应

200

跳转记录

URL
https://meta.webweb1-whatsapp.com/
状态
200
URL
https://web.whatsapp.com/
状态
200

DOM 结构哈希

8287c458b2bb17f7934d0641593108c0798175cb15ff74bd99ff30ffeb826d92

文档哈希值

c59893b6a1141a19479d4253cb491205802d575a1b86509b43a2df130dfcc23f