public company · US
Meta (Facebook)
Meta Platforms, Inc.
Facebook, Instagram and WhatsApp.
- Primary official domain
- facebook.com
- Reviewed official domains
- 5 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
152
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
174
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 1/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- facebookinstagrammetaplatformswhatsapp
- Label aliases
- Facebook · Instagram · Meta Platforms · WhatsApp · Meta
- Official domains
- meta.com · facebook.com · fb.com · instagram.com · whatsapp.com (all)
- Generated spellings
- 400 tracked · 179 observed somewhere · 221 not observed (all)
- Can receive mail
- 3 spellings and 32 reported domains publish MX records · mail at Google 6 · iFastNet 4 · Cloudflare Email Routing (mail forwarding) 2 · 22 more (5 spellings and 152 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
whatsappget[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive176.97.114.120 · Confirmed phishing host address (DomainSpoof, 14 days)VIRTUALSYSTEMS (AS6698) · UAmx.veltrasolutions.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whatsappgu[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
whatsappnk[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
whatsappsk[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
pp[.]whatsappuk[.]ccMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive103.163.208.118 · Confirmed phishing host address (DomainSpoof, 14 days)HKISP-AS-AP OWGELS INTERNATIONAL CO., LIMITED (AS153656) · HKchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whatsappvirtual[.]comMail: DMARC · checked 2026-10-19DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive160.153.0.203CloudflareCloudflare (AS209242) · US203.0.153.160.host.secureserver.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whatsappweb-news[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.53.179.136TEAMINTERNET-CA-AS (AS206834) · DEchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whp-app-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.252.40.16 · Confirmed phishing host address (DomainSpoof, 14 days)GNETINC-AS-AP GNET INC. (AS9294) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whp-web-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.252.40.14 · Confirmed phishing host address (DomainSpoof, 14 days)GNETINC-AS-AP GNET INC. (AS9294) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whs-web-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.252.40.13 · Confirmed phishing host address (DomainSpoof, 14 days)GNETINC-AS-AP GNET INC. (AS9294) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
instagram[.]williamzshih[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Cloudflare Email Routing (mail forwarding) · DMARC policy none (monitor only) · sends via Cloudflare Email Routing | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.198.79.65Amazon Web ServicesAmazon Web Services (AS16509) · US64.29.17.65Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
wis-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.252.44.5 · Confirmed phishing host address (DomainSpoof, 14 days)GNETINC-AS-AP GNET INC. (AS9294) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
wjm-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.252.43.28 · Confirmed phishing host address (DomainSpoof, 14 days)GNETINC-AS-AP GNET INC. (AS9294) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whatsapp[.]wooflers[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPFDMARC · checked 2026-10-19mail at mail.wooflers.com · DMARC policy reject · sends via GoDaddy | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive68.178.238.223 · Confirmed phishing host address (DomainSpoof, 14 days)GoDaddyGoDaddy (AS26496) · US223.238.178.68.host.secureserver.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
woshuo-whatsapp[.]hk[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.36.176CloudflareCloudflare (AS13335) · US172.67.197.237CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:c5edCloudflareCloudflare (AS13335) · US2606:4700:3032::6815:24b0CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
wqsn-web-whatsapp[.]hk[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.51.15CloudflareCloudflare (AS13335) · US172.67.217.244CloudflareCloudflare (AS13335) · US2606:4700:3036::6815:330fCloudflareCloudflare (AS13335) · US2606:4700:3036::ac43:d9f4CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
wswaim-whatsapp[.]hl[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.49.20CloudflareCloudflare (AS13335) · US172.67.188.198CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:bcc6CloudflareCloudflare (AS13335) · US2606:4700:3035::6815:3114CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
wswsweb-whatsapp[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.26.236CloudflareCloudflare (AS13335) · US172.67.168.152CloudflareCloudflare (AS13335) · US2606:4700:3032::6815:1aecCloudflareCloudflare (AS13335) · US2606:4700:3032::ac43:a898CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
wwb-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.252.42.21 · Confirmed phishing host address (DomainSpoof, 14 days)GNETINC-AS-AP GNET INC. (AS9294) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
wwp-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive154.221.9.137 · Confirmed phishing host address (DomainSpoof, 14 days)ASLINE-AS-AP ASLINE LIMITED (AS137951) · HKchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
www-app-web-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive154.221.9.156 · Confirmed phishing host address (DomainSpoof, 14 days)ASLINE-AS-AP ASLINE LIMITED (AS137951) · HKchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
www-mfacebook[.]com[.]vnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive206.206.126.131 · Confirmed phishing host address (DomainSpoof, 14 days)OVHOVH (AS16276) · FRchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whatsapp[.]xolura[.]comMail: MXSPFDMARC · checked 2026-10-19mail at mail.xolura.com · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.29.225CloudflareCloudflare (AS13335) · US172.67.171.223CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:abdfCloudflareCloudflare (AS13335) · US2606:4700:3034::6815:1de1CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
zh-whatsapp-hk[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
zoom-whatsapp[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
152 registrable domains · 160 hostnames · page 6 of 7← PreviousNext →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.