ScanMalware.com
WhatsApp logo

WhatsApp phishing & impersonation

Socialwhatsapp.net
34
Sites impersonating it
17
New in the last 30 days
2
Campaigns
2026-11-14
Last detected
New sites per day, last 90 days30 new sites · busiest day 3
2026-08-25: 3 new sites2026-08-31: 1 new site2026-10-03: 2 new sites2026-10-07: 2 new sites2026-10-08: 1 new site2026-10-09: 1 new site2026-10-14: 1 new site2026-10-15: 1 new site2026-10-16: 1 new site2026-10-19: 1 new site2026-10-21: 2 new sites2026-10-22: 1 new site2026-10-23: 2 new sites2026-10-24: 2 new sites2026-10-25: 1 new site2026-10-26: 1 new site2026-11-03: 2 new sites2026-11-06: 1 new site2026-11-07: 1 new site2026-11-09: 1 new site2026-11-11: 1 new site2026-11-14: 1 new site
2026-08-182026-11-15
Where these sites are hosted

21 on free hosting platforms, 42 on 34 registered domains

vercel.app · 12pages.dev · 3blogspot.com · 2herokuapp.com · 1workers.dev · 1replit.app · 1.com · 21.dev · 8.app · 3.com.cn · 2.hl.cn · 2.net · 2

Campaigns

Phishing kits we track as hunts, and how many of the sites below each one covers. A site can belong to more than one.

Fake WhatsApp Web pages that link the victim's account to an attacker device, behind Chinese search-engine doorwayscritical
10 of 34 sites · last 2026-10-22
gasing777 Indonesian Gambling Kit — uc_login.jscritical
2 of 34 sites · last 2026-07-21
1 related hunt
Official domains
whatsapp.netwhatsapp.com

A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.

Sites impersonating WhatsApp

50 of 63 sites · newest first · repeat scans of a site are grouped

Showing all sites, including 29 lower-risk copies that neither our rule engine nor our AI analysis rates high risk. Hide them

54 further sites are not listed at all: the WhatsApp name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).

← All monitored brandsSearch these scansDownload CSVDownload JSONAPI