public company · US

Western Union

Western Union CO

Primary official domain
westernunion.com
Reviewed official domains
1 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
2
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
2
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF Could not fully evaluate (sender-specific macros) · Mail: Not checked · checked 2026-10-19 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
westernunion
Label aliases
Western Union
Official domains
westernunion.com (all)
Generated spellings
145 tracked · 65 observed somewhere · 80 not observed (all)

Certificate domains matching this brand

Names identified in certificate logs that match this company or brand. A brand match does not indicate bad intent or malicious activity.

Matching domain groups, 30 days
12
distinct registrable domains with a matching certificate name, by latest CT log time; not attacks
Reviewed official
0
groups on this organization's reviewed official domains, 30 days
Not assessed
12
groups with the brand in the name and no review; no judgement implied
Latest CT observation
2026-10-19 07:37 UTC
log timestamp, not issuance or collection time
Matching domain / nameMatched brand / domainMatch typeFirst CT observationLatest CT observationDistinct certificatesRelationshipSource-reported abuseDetails
westernunion.net5 names
westernunion.netGenerated spelling2026-10-19 05:54 UTC2026-10-19 07:37 UTC10Not assessedNo report in sample coverage
webapi-qa.cams.care.westernunion.net
westernunion.netGenerated spelling2026-10-19 07:37 UTC2026-10-19 07:37 UTC2Issuer Sectigo Public Server Authentication CA OV R40
webapp-qa.cams.care.westernunion.net
westernunion.netGenerated spelling2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Issuer Sectigo Public Server Authentication CA OV R40
content-dev.cams.ecdn.westernunion.net
westernunion.netGenerated spelling2026-10-19 06:38 UTC2026-10-19 06:38 UTC2Issuer Sectigo Public Server Authentication CA OV R40
webapi-dev.cams.care.westernunion.net
westernunion.netGenerated spelling2026-10-19 06:28 UTC2026-10-19 06:28 UTC2Issuer Sectigo Public Server Authentication CA OV R40
webapp-dev.cams.care.westernunion.net
westernunion.netGenerated spelling2026-10-19 05:54 UTC2026-10-19 05:54 UTC2Issuer Sectigo Public Server Authentication CA OV R40
ffsandusr0frwesternunionholdings.ph1 name
westernunionBrand token in name2026-10-19 07:33 UTC2026-10-19 07:33 UTC1Not assessedNo report in sample coverage
www.ffsandusr0frwesternunionholdings.ph
westernunionBrand token in name2026-10-19 07:33 UTC2026-10-19 07:33 UTC1Issuer YE2
westernunion3.ph1 name
westernunionBrand token in name2026-10-19 07:15 UTC2026-10-19 07:15 UTC1Not assessedNo report in sample coverage
westernunion3.ph
westernunionBrand token in name2026-10-19 07:15 UTC2026-10-19 07:15 UTC1Issuer YE2
sslwesternunion.ph1 name
westernunionBrand token in name2026-10-19 06:57 UTC2026-10-19 06:57 UTC2Not assessedNo report in sample coverage
sslwesternunion.ph
westernunionBrand token in name2026-10-19 06:57 UTC2026-10-19 06:57 UTC2Issuer YE2
westornunion.com1 name · includes wildcard names
westornunion.comGenerated spelling2026-10-19 06:55 UTC2026-10-19 06:55 UTC1Not assessedNo report in sample coverage
westornunion.com
westornunion.comGenerated spelling2026-10-19 06:55 UTC2026-10-19 06:55 UTC1Issuer YR1
*.westornunion.comWildcard certificate name: a pattern, not an observed live host
westornunion.comGenerated spelling2026-10-19 06:55 UTC2026-10-19 06:55 UTC1Issuer YR1
ffsandusr0westernunionde.ph1 name
westernunionBrand token in name2026-10-19 06:47 UTC2026-10-19 06:47 UTC2Not assessedNo report in sample coverage
www.ffsandusr0westernunionde.ph
westernunionBrand token in name2026-10-19 06:47 UTC2026-10-19 06:47 UTC2Issuer YE1
ffsandusr0westernunion-tomorrow.ph1 name
westernunionBrand token in name2026-10-19 06:40 UTC2026-10-19 06:40 UTC2Not assessedNo report in sample coverage
www.ffsandusr0westernunion-tomorrow.ph
westernunionBrand token in name2026-10-19 06:40 UTC2026-10-19 06:40 UTC2Issuer YE1
access-logswesternunionholdings.ph1 name
westernunionBrand token in name2026-10-19 06:15 UTC2026-10-19 06:15 UTC2Not assessedNo report in sample coverage
access-logswesternunionholdings.ph
westernunionBrand token in name2026-10-19 06:15 UTC2026-10-19 06:15 UTC2Issuer YE1
chinawesternunion.ph1 name
westernunionBrand token in name2026-10-19 05:25 UTC2026-10-19 05:25 UTC1Not assessedNo report in sample coverage
www.chinawesternunion.ph
westernunionBrand token in name2026-10-19 05:25 UTC2026-10-19 05:25 UTC1Issuer YE2
westernunion-mh.com.ph1 name
westernunionBrand token in name2026-10-19 05:17 UTC2026-10-19 05:17 UTC1Not assessedNo report in sample coverage
www.westernunion-mh.com.ph
westernunionBrand token in name2026-10-19 05:17 UTC2026-10-19 05:17 UTC1Issuer YE1
westernunionholdings-azure.ph1 name
westernunionBrand token in name2026-10-19 05:14 UTC2026-10-19 05:14 UTC1Not assessedNo report in sample coverage
westernunionholdings-azure.ph
westernunionBrand token in name2026-10-19 05:14 UTC2026-10-19 05:14 UTC1Issuer YE1
ffsandusr0virtual-westernunion.ph1 name
westernunionBrand token in name2026-10-19 05:06 UTC2026-10-19 05:06 UTC1Not assessedNo report in sample coverage
www.ffsandusr0virtual-westernunion.ph
westernunionBrand token in name2026-10-19 05:06 UTC2026-10-19 05:06 UTC1Issuer YE2

Collected from public certificate-transparency logs since 2026-10-18; 35,695,494 log entries checked so far. 80 logs are read continuously by our CT resolver from the point it started following them; earlier entries are not covered. Names on an organization's official domains are recorded by the resolver for at most 100 names per registrable domain per day, so official-domain name and certificate counts are lower bounds. Times are CT log timestamps, which differ from certificate validity dates. Certificate counts include precertificates and final certificates as separate artifacts. The "Source-reported abuse" badge appears only when an independent source reported that exact name for this organization; a certificate name match never creates it, and "No report in sample coverage" is not a safety verdict. How CT works