What happened
Phishing tracker @phishunt_io posted on X on 13 November 2026 that whatsappsdzuan[.]cfd is a WhatsApp phishing site. According to the post, the domain was registered on 12 November 2026 through NameMart and resolves to 107.150.41.178 at Nocix (AS33387) in the United States. The domain also appears on the Phishing Army extended blocklist, a public phishing domain blocklist. This is not a WhatsApp or Meta domain, and WhatsApp is impersonated. Link or verify WhatsApp only inside the official app; never enter a WhatsApp verification code or scan a login QR code on a website you were sent. Source: https://x.com/phishunt_io/status/2121226916246044874
How the scam works
These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.
Source
Source: https://x.com/phishunt_io/status/2121226916246044874
