Criticalscore 67 · flagged Friday, August 28, 2026

whatsappnew.icu

Appeared in the .icu zone on Friday, August 28, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: whatsapp
+30
TLD with a high abuse rate
matched: icu
+8
brand name at a retail registrar
matched: Gname.com Pte. Ltd.
+8
brand name at a watch-list registrar
matched: Gname.com Pte. Ltd.
+6
brand name and brand-styled page
matched: whatsapp
+15
Registrar
Gname.com Pte. Ltd.
Nameserver provider
Nameservers
a7.share-dns.com, b7.share-dns.net
First-day state
active website
HTTP status
200
Page title
WhatsApp 安全中心
Has a form
no
Brand echoed
whatsapp

Model opinions

Second opinionlooks like phishingtarget: WhatsAppconfidence 97%· claude-opus-5

Page brands itself 'WhatsApp 安全中心 / Security Center' with WhatsApp logo and a fake 'account banned – request review' flow that collects a phone number and then displays a 'link WhatsApp account' code to enter on the victim's phone — a classic device-linking account-takeover phish on a brand-in-name .icu domain.

First passlooks like phishingtarget: WhatsAppconfidence 98%· claude-haiku-4-5

The domain whatsappnew.icu impersonates WhatsApp's official branding with a fake 'WhatsApp Security Center' page that uses WhatsApp's logo, color scheme, and terminology to deceive users into entering phone numbers and verification codes under the pretext of account restriction review. The page mimics WhatsApp's legitimate account recovery flow to harvest credentials and personal data, with no legitimate connection to Meta/WhatsApp's actual infrastructure.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, August 28, 2026

Screenshot of whatsappnew.icu taken by the zone census on 2026-08-28

Same data as JSON: /api/zone/domain/whatsappnew.icu. This page is not indexed by search engines and does not link to the site it describes.