Skip to content
Scammers.com
PhishingReviewed

Researcher flags whatsappr.cc WhatsApp phishing domain registered a day earlier

phishunt.io flagged whatsappr.cc, registered 8 November 2026, as a WhatsApp phishing site behind Cloudflare. WhatsApp/Meta is not involved.

First reported
Reports
1

Source: x.com · published

Screenshot of a fake WhatsApp Web login page on whatsappr.cc with a +86 phone field
Image: phishunt.io (via X)

What happened

On 9 November 2026 the phishing tracker @phishunt_io posted on X that whatsappr[.]cc is a WhatsApp-themed phishing site. The post said the domain was registered on 8 November 2026 through Dynadot, resolves to 188.114.97.3 behind Cloudflare (AS13335), and linked it from phishunt.io's WhatsApp tracker page. The domain also appears on the Phishing Army blocklist. It is not an official WhatsApp or Meta address, and WhatsApp and Meta are not involved.

How the scam works

The researcher's screenshot shows a page made to look like WhatsApp Web, with a phone-number field and a China (+86) country code. Pages like this usually ask for a phone number and then a verification or pairing code. Anything entered goes to whoever runs the site rather than to Meta, and a stolen pairing code can link the victim's chats to an attacker's device.

WhatsApp phishing links commonly arrive in messages claiming your account will be banned, that a friend shared a document, or that you need to verify a new login. Because the domain was only a day old when flagged, many filters may not yet block it. WhatsApp's real web client is web.whatsapp.com; any other address offering WhatsApp Web or a QR login should be treated as fake.

Anyone who entered a number or code on whatsappr.cc should open WhatsApp, check Settings and Linked devices, unlink anything they do not recognise, and change the password on their email account if it is tied to WhatsApp recovery. The indicators come from the tracker's post and have not been independently checked by scammers.com.

Source

Post by @phishunt_io on X, 9 November 2026, flagging whatsappr.cc. Not independently verified by scammers.com.

Red flags

  • A WhatsApp Web page whose address is not web.whatsapp.com.
  • A newly registered domain using the WhatsApp name, such as whatsappr.cc.
  • A request for your phone number and verification or pairing code after following a link.
  • A message saying your WhatsApp will be banned unless you verify through a link.

If you were targeted

  1. 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
  2. 2Open the company's official app or type its address yourself to check your account.
  3. 3If you entered details, change your password at once and contact the company through its official channels.
  4. 4Report the message and the link to the company and to your national phishing reporting service.
  5. 5Delete the message without replying or tapping any links.
  6. 6In WhatsApp, open Settings > Linked devices and unlink anything you do not recognise.
ReportFraud.ftc.gov FBI IC3 More resources

Related reports

All phishing reports
Government impersonationReviewed

Researcher flags fake Tokyo Metropolitan Police sites on jp.kdfz.net and four similar hosts

Security researcher @catnap707 posted on X on 12 November 2026 about fake websites (偽サイト) impersonating the Tokyo Metropolitan Police Department (警視庁). The post lists the links jp[.]kdfz[.]net, jp[.]kstw[.]net, jp[.]k…

  • jp.kdfz.net
  • Also jp.kstw.net, jp.kswt.net, jp.ksxz.net, jp.kdfx.net; IPs 180.178.61.26-30 (AS963)
  • Police or government impersonation and fake-bank callers (12 Nov 2026)
Reported Nov 12, 20261 report
PhishingReviewed

GMX.net email login phishing page at xncok12.weebly.com

PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…

  • xncok12.weebly.com
  • Weebly subdomain; VirusTotal 17/92
Reported Nov 12, 20261 report