Executive Summary
Target: WhatsApp
Research Source: PreCrime™ Labs
BforeAI’s PreCrime™ Labs identified an 11-domain cluster impersonating or pre-positioning against WhatsApp’s username feature, recently announced by Meta on Jun 29, 2026. The registration activity shows a staggering wave targeting “username” keywords through a six-domain series within a 48-hour window on 29–30 June 2026, right after this notice.
The targets are end users searching for or anticipating a WhatsApp username/handle capability, a newly announced feature already familiar from Telegram and Instagram. What makes this cluster operationally distinct is its infrastructure where the domains are split across at least seven registrars and multiple TLDs (“.com”, “.com.cn”, “.cc”, “.online”, “.store”). One high-value TLD variant (“.in”) remains unregistered, representing an open pre-emption window.
Key Indicators (IOCs): WhatsApp Username Phishing Domain List
Domains (defanged)
- whatsappusername[.]com
- mention-user-whatsapp[.]com[.]cn
- user-session-whatsapp[.]com[.]cn
- whatsapp-user[.]com
- wausername[.]com
- whatsappusernames[.]com
- whatsappusername[.]online
- whatsappusername[.]store
- wausernamegenerator[.]com
- whatsappusername[.]cc
Patterns observed
Keyword scaffolding consistently combines a WhatsApp reference (“whatsapp” / “wa”) with a functional term: “username,” “user,” or “generator.”
Two domains (whatsappusername[.]online, whatsappusername[.]store) share identical Cloudflare nameservers (megan/wilson[.]ns[.]cloudflare[.]com) despite being registered through GoDaddy on the same day, suggesting a strong same-operator signal.
The observed webpages present itself as an unofficial WhatsApp Username reservation service, encouraging users to reserve their desired ‘@username’ before the feature is officially available.
The site advertises functionality such as username availability checks, waitlist enrollment, queue positioning, reservation tracking, and launch notifications, while explicitly labeling itself as an “Unofficial demo.”
It also promotes a “Free waitlist” and simulates a reservation workflow to capitalize on anticipation surrounding WhatsApp’s upcoming username feature.
Forward Indicators (IOFC – Preemptive Detection)
How predictive patterns elevate indicators of future attacks.
Predictive patterns
Domain structure template: [wa|whatsapp]-[user|username|usernames]-[generator|session|mention][.TLD], with TLD substitution across “.com”, “.online”, “.store”, “.cc”, “.com.cn”.
Keyword clustering: “whatsapp”, “wa”, “user”, “username”, “session”, “mention”, “generator”.
Newly registered domains (last 30 to 60 days) combining “whatsapp” or “wa” with “username,” “session,” “mention,” or “handle” in any order or common substitution (0/o, 1/i).
Registration velocity
Who Is Being Targeted by the WhatsApp Username Scam?
Target users
Individuals searching for or attempting to claim a WhatsApp username ahead of, or immediately following, any official feature rollout.
Users interested in “username generator” or “session” tools who may not distinguish unofficial third-party sites from an official WhatsApp or Meta property.
This has eventually led to marketplace emergence of WhatsApp usernames, allowing users to buy, sell, and request premium handles. The platform advertises a mediated transaction model, protected payments, username availability checks, and listings for premium usernames at varying prices. By positioning usernames as digital assets, the service attempts to establish a secondary market around anticipated demand for desirable WhatsApp handles.
Delivery vector
Search-engine discovery and social sharing of “WhatsApp username” related queries; abbreviation variants (wausername[.]com) also catch users abbreviating “WhatsApp” as “WA.”
No malvertising or spam-distribution vector confirmed at time of writing; domains are pre-positioned for sale and suggests personally identifiable information (PII) harvesting.
What's the Risk? Impersonation, Squatting, and Account Takeover
The emergence of username marketplaces highlights the potential for username squatting, brand impersonation, and cybersquatting as WhatsApp usernames become widely available.
Although the page discloses that it is unofficial, it demonstrates how emerging platform features can be leveraged to collect user interest, usernames, contact details, or other personal information ahead of an official rollout.
High-value usernames associated with brands, public figures, organizations, and influencers may be reserved or traded for profit, increasing the risk of impersonation and social engineering.
If activated as credential or session-token capture pages, these domains could enable WhatsApp account takeover via session-hijack style flows implied by the “session” and “mention” naming pattern.
Demonstrated ability to register 6 domains across 5 registrars within 48 hours indicates the actor(s) can scale the cluster further with minimal lead time as long as the feature update remains popular.
How to Block These WhatsApp Username Phishing Domains
1. Immediate actions
Block and monitor the 10 registered domains listed in email-gateway layers.
Alert on any inbound traffic or DNS queries matching the [wa|whatsapp]-[user|username|session|mention|generator] pattern across any TLD.
Monitor for content changes on currently parked domains, a shift from parking-page to functional content is the key activation signal.
2. Preemptive security actions (IOFC-aligned context)
Monitor newly registered domains combining WhatsApp-related keywords with “username,” “session,” “mention,” or “handle,” including common character substitutions.
Consider preemptive or defensive registration or continuous monitoring of the unregistered variants and equivalent keyword permutations.
PreCrime™ Predicts
The rapid emergence of WhatsApp username-themed domains, unofficial reservation portals, and premium username marketplaces indicates that threat actors and opportunistic actors are already positioning infrastructure ahead of the feature’s widespread rollout. The appearance of these services, content structuring, thematic adaptations for monetizing or data collection purposes suggests early and continuous monitoring of username-related abuse.
WhatsApp Username Scam: FAQ
What is being targeted?
A WhatsApp username feature and adjacent “session” and “mention” functionality. The naming pattern suggests pre-positioning ahead of, and in response to, public popularity about this feature.
Are these domains currently hosting phishing content?
No, at the time of analysis, some of the observed domains hosted unofficial username reservation and marketplace services rather than credential-harvesting pages, though they demonstrate how the feature can be leveraged for future abuse.
Why does the registration burst on 29–30 June 2026 matter?
Six of the eleven domains, more than half the cluster, were registered within a single 48-hour window across five different registrars and three different TLDs. That concentration indicates infrastructure positioning to capitalize on user demand, increasing the potential for future phishing, impersonation, and cybersquatting campaigns.
Is this tied to broader monetization activity?
Yes. The observed services attempt to monetize the upcoming feature through username reservations, premium handle sales, brokerage services, and waitlists, demonstrating the emergence of a secondary commercial ecosystem around WhatsApp usernames.
