securitywhat.app
Appeared in the .app zone on Friday, October 30, 2026; by the end of that day the census found active website. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The page uses WhatsApp's logo, a verified badge and "Servicio propiedad de Meta" branding on a domain WhatsApp does not own. It collects the victim's phone number, then shows a pairing code to "introduce dentro de WhatsApp para vincular nuestro gestor", the standard device-linking account-takeover scheme dressed up as two-step verification setup.
The page impersonates WhatsApp with its logo, title ('WHATSAPP · Conectar mi cuenta'), and branding, but the domain 'securitywhat.app' is not WhatsApp's. It presents a fake two-factor verification form claiming to be 'Web no oficial de WhatsApp' while asking users to enter phone numbers and confirm codes—a classic credential/account takeover phish. The form posts to itself with no legitimate offsite links, matching the sealed-room phishing pattern.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, October 30, 2026
Same data as JSON: /api/zone/domain/securitywhat.app. This page is not indexed by search engines and does not link to the site it describes.