Security Scan Report: dataauth-whatsapp.com

Redirected to:
https://tw.yahoo.com/?guccounter=1
Site favicon
Submitted: Completed: publiccompleted
This website contacted 146 IPs in 13 countries across 132 domains to perform 985 HTTP transactions. The main domain is dataauth-whatsapp.com and was registered 2 weeks ago.

Submitted URL: http://dataauth-whatsapp.com/

Effective URL:
https://tw.yahoo.com/?guccounter=1
Redirected

AI Security Verdict

High Risk

Confidence: 68%

7
Risk Score

Landing page is genuine Yahoo Taiwan, but the entry host dataauth-whatsapp.com carries an unverified phishing report and bounces users through 51 cross-domain redirects to ad networks. Treat the redirector as unsafe; the destination itself shows no phishing content.

Risk Factors (4)
Single-source phishing threat-intel match on the entry domain
Excessive cross-domain redirect chain (51 redirects, 35 cross-domain) ending in third-party ad servers
Entry hostname unrelated to the content it ultimately serves, typical of abused redirector domains
20 HIGH Suricata alerts for HTTP requests to *.tw domains (potentially bad traffic)
Domain age information unavailable

Details

Page Title

Yahoo

Scan Type

public

Domain Name Analysis

The domain 'dataauth-whatsapp.com' uses the commercial generic top-level domain (.com) with no subdomain. Its registrable label 'dataauth-whatsapp' stretches across 17 characters with 6 vowels and 10 consonants; it also includes 1 hyphen. Tokenizing the label suggests 6 words: data, au, th, what, s, app. Median word length comes out to 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://dataauth-whatsapp.com/

Page Load Overview

3.85s
Total Load Time
19.0 MB
Total Size

Language Analysis

Primary Language

🇰🇷Korean
Code: ko
Confidence:62%
Script:Hangul
Direction:ltr

Detection Details

HTML Lang Attribute:zh-Hant-TW
Text Length:19,745 chars
Detector Agreement:75%
Language mismatch: Declared as zh-Hant-TW but detected as ko

Website Classification

Primary Category

forum40% confidence
Type: spa
Method: structural

All Detected Categories

forum
40%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
11554.220.29.121Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
6207.148.34.245Hong Kong, Hong Kong
AS59371Dimension Network & Communication Limited
687.248.119.252United Kingdom
AS203220Yahoo-UK Limited
6188.125.72.139Dublin, Leinster, Ireland
AS34010Yahoo-UK Limited
687.248.119.251United Kingdom
AS203220Yahoo-UK Limited
6108.132.98.138Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
654.246.15.254Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
63.161.82.31Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
6192.178.183.155Google · CDNUnited States
AS15169Google LLC
6146.75.121.44Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
985146--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T192352CB69232C52B945FACE8A5713F2960C7932BCE8686ECF6DCC20057C6CB156D724D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12288:d8JucbugTHcej0JxL2GQxyZS1FQGshGLpLsM6I+v:dDemdCyYshZM6L

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1068575:Yoa0BZCEQAKAHRQIh2oAARGsMP0wMAUJUDgoIYUIebFAUECmBhBOSFjGRDQRxk9AAIYFIlKPYMRMOUqAA4EQgFkAEgxVgAYg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffcfc7c7ddff
Perceptual Hash:b8c7ce3831cec643
Difference Hash:271a609e9e9da92e
Wavelet Hash:d3bf81c38387c583
Color Hash:#862d67

Scan History

Scan history not available

Unable to load historical scan data