wabulk-net[.]pages[.]dev

PhishDestroy has identified wabulk-net.pages.dev as a high-risk threat actively impersonating the WhatsApp brand to harvest user credentials. This domain, titled 'WhatsApp Tools and Extensions - Enhance Your Messaging Experience | WABULK', lures victims with promises of enhanced messaging features, but its true purpose is credential theft through a fake login interface. The site is hosted via Cloudflare Pages and resolves to IP 188.114.97.3, with an SSL certificate issued by Google Trust Services (WE1). Despite only 1 out of 95 security vendors flagging it on VirusTotal, its presence on one security blocklist and the clear brand impersonation warrant immediate concern.

The technical indicators paint a clear picture of malicious intent. The domain was created on March 27, 2026, a very recent date typical of phishing campaigns. It is not currently listed on Google Safe Browsing, but that does not diminish the risk. The low detection rate (1/95) suggests the domain is new and evading traditional security filters, making it especially dangerous for unsuspecting users. The use of Cloudflare Pages provides anonymity and resilience against takedown attempts.

As of this advisory, wabulk-net.pages.dev remains active and accessible. Users who have interacted with this site should change their WhatsApp passwords immediately and enable two-factor authentication. PhishDestroy recommends blocking this domain at the network level and reporting it to Cloudflare and Google Safe Browsing. The risk of credential compromise is high, and further propagation via phishing emails or social engineering is likely. Vigilance is advised, as similar domains may appear under different subdomains or TLDs.