EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of guardwhatsapp.com

Detection Info

http://guardwhatsapp.com
Detected Brand
WhatsApp
Country
Turkey
Confidence
95%
HTTP Status
200
Report ID
9bef7bc3-bf5…
Analyzed
2026-01-26 01:33
Final URL (after redirects)
https://guardwhatsapp.com/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1AE914064A042B63B829FE2E29774432B27D683A7EA131619C3F8D30C0FCAC49ED95115
CONTENT ssdeep
96:yen9KSZSZSZSZSJSZSZSZSZSjuUAgA0XaaiHonULKlzPyEYv:yen9HIIII4IIIIaUzA+arHoU+ljyEYv

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
8c2b332c8babce33
VISUAL aHash
01003d3f1f3f071f
VISUAL dHash
37fee171a1a3dff6
VISUAL wHash
0103033f3f1f1f1f
VISUAL colorHash
38003000c00
VISUAL cropResistant
37fee171a1a3dff6

Code Analysis

Threat Level ALTO
⚠️ Phishing Confirmed

🔬 Threat Analysis Report

• Threat: Fake WhatsApp message protection service
• Target: WhatsApp users in Turkey
• Method: Misleading users to believe they need to protect their messages
• Exfil: No direct data exfiltration detected
• Indicators: Non-official domain, recent domain registration, misleading claims
• Risk: HIGH - Potential for future data theft or malware distribution

🎯 Kit Endpoints

  • login2.php
  • login2.php?register=1

📡 API Calls Detected

  • POST

📊 Risk Score Breakdown

Total Risk Score
35/100

Contributing Factors

Brand Impersonation
Impersonates WhatsApp brand using stolen logos and branding elements

🔬 Comprehensive Threat Analysis

Threat Type
Unknown Threat
Target
WhatsApp users (Turkey)
Attack Method
Brand impersonation
Exfiltration Channel
Unknown
Risk Assessment
LOW - Automated credential harvesting with Unknown

🏢 Brand Impersonation Analysis

Impersonated Brand
WhatsApp
Official Website
https://www.whatsapp.com
Fake Service
Fraudulent service portal

Fraudulent Claims

⚔️ Attack Methodology

Primary Method: Brand Impersonation Redirect

Impersonates WhatsApp to build victim trust through search engine manipulation or malicious advertisements. Often redirects to credential theft pages or serves malware disguised as legitimate software.

Secondary Method: Standard Phishing Techniques

Uses typical phishing tactics including brand impersonation, urgency tactics, and social engineering to trick victims into providing sensitive information.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
guardwhatsapp.com
Registered
2026-01-22 10:57:53+00:00
Registrar
TUCOWS.COM, CO.
Status
Recently registered (3 days old)

Hosting Information

Provider
TUCOWS.COM, CO.
ASN

🔬 JavaScript Deep Analysis

Operator Language
English (1%)
Total Code Size
19.5 KB

🔗 API Endpoints Detected

Other
1

🔐 Obfuscation Detected

  • : Light

🤖 AI-Extracted Threat Intelligence

Scan History for guardwhatsapp.com

Found 1 other scan for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.