What Gridinsoft observed on Go.wha.link
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825041619-4acf5eac
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- WhatsApp Link Service — Object-Specific Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review did not reproduce behavior supporting the broad Suspicious Website classification on go.wha.link. The fresh Gridinsoft result named no harmful object, and the active short code, two retrievable archive objects, and five public scan screenshots consistently showed WhatsApp invitation flows without an arbitrary web destination, credential collector, malicious download, payload, or hash. The older public sandbox record concerns a specific group.wha.link page and generic runtime activity, not a current malware sample on the exact host. The unsupported broad host detection should therefore be removed. Because go.wha.link remains a user-created short-code namespace whose complete contents and destination conversations cannot be enumerated, this is not a certification of every code; future concerns require exact-object and destination-specific review.
Analyst findings
Review 8 documented observations View evidence
A fresh supported Gridinsoft rescan completed for go.wha.link and retained the existing Suspicious Website category. The current result reached the host with HTTP 200 but did not identify a current harmful behavior signal or name an exact malicious URL, phishing receiver, unrelated redirect, malware file, payload, exploit, command, or hash.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/go-wha-link
-
HTTP status
200 - Page element Suspicious Website
- Analyst observation The fresh report did not identify a current positive behavior observation or an exact harmful object supporting the retained broad category.
The current public short-code page returned HTTP 200 and presented a named WhatsApp-group invitation. Its complete HTML contained a WhatsApp group code and navigation branches only to the WhatsApp application scheme, web.whatsapp.com, or chat.whatsapp.com. No arbitrary third-party web destination, executable or archive download, credential form, automatic file delivery, or malware payload was present in the reviewed response.
-
HTTP status
200 -
Final URL
https://go.wha.link/dPYqne - Page element Invitacion a grupo de WhatsApp
-
Redirect destination
https://web.whatsapp.com/accept -
Redirect destination
https://chat.whatsapp.com/ - File SHA-256 1a3597cd4e7e1bf0d59ea378da810bd22e855d71267137a0f83d920e8f31a7dc
The public urlscan index contained six exact go.wha.link page results from March through July 2026. Five available screenshots were inspected and consistently showed Funnelchat-branded WhatsApp group invitation pages for business, education, and event communities. The indexed result metadata did not expose a malicious verdict or a downloaded executable, and the screenshots did not show a credential form, fake update, command instruction, or unrelated destination page.
- Public artifact URL https://urlscan.io/result/019f8aef-852f-75dd-a9c7-0c06f864446a/
- Public artifact URL https://urlscan.io/result/019f761f-57b1-70f7-912b-2ab98004880a/
- Public artifact URL https://urlscan.io/result/019ece5a-82c6-749e-b4cf-c1692ee19d6c/
- Public artifact URL https://urlscan.io/result/019e27df-d41a-75fe-85b7-0595cc852386/
- Public artifact URL https://urlscan.io/result/019d2a94-42ca-730d-81a5-0bb4da3d63ec/
- Screenshot SHA-256 4d8368ee6b8b673e68161233ea295ec0c9509e29030375073b0b8dfc4f6dff8a
- Screenshot SHA-256 4a6e536a0f2d40ab62203fb97691fc50c1fa283895825a802b47a4c4d7565d25
- Screenshot SHA-256 59923000ee8d9b26d930519ca3170ba35455aabb29f43b2447ffa385f6a3f648
- Screenshot SHA-256 a17e95ea76dbc6e877c9434f02a5fa5a23216ef66c8473c1d638d03b8228f898
- Screenshot SHA-256 fc4d22aba4b71a5c4f42289316171ac745825a197f131ec7b002e950aa312447
The Internet Archive index returned four distinct HTTP-200 captures under go.wha.link. Two retrievable short-code snapshots from April 2026 contained explicit WhatsApp group codes and navigation branches only to the WhatsApp application, web.whatsapp.com, or chat.whatsapp.com. The sampled snapshots did not contain an unrelated web destination, executable or archive reference, credential collection form, or specific malicious payload.
- Public artifact URL https://web.archive.org/web/20260410165021id_/https://go.wha.link/bk6XXa
- Public artifact URL https://web.archive.org/web/20260430131030id_/https://go.wha.link/bm7xGe
- File SHA-256 5a5874a747c1c67715fed9943d52cb21efaabf9c831712bf658d2fd807176d96
- File SHA-256 d38fa19167773c26c31afc6789e34ae07ac5201ea5443aa7056fd3eb3dcb9734
- Analyst observation The archive index is a finite public sample, not a complete inventory of all historical or current short codes.
The public Falcon Sandbox record covers the specific URL group.wha.link/dBL7Xa from July 2025, not an exact go.wha.link object. Its visible indicators describe browser processes, DNS and HTTP requests, a downloaded page image, and an extracted HTML document. The public record does not identify a malware executable, payload hash attributable to the service, credential receiver, exploit, or harmful destination reached from that object. The same group URL now returns HTTP 403.
- Public artifact URL https://hybrid-analysis.com/sample/0af07acd1724f5e8517130cde693d5870d137c09474aaddba35a9975453ecc95/687dd1eff16f1b208e04a22d
-
Final URL
https://group.wha.link/dBL7Xa -
HTTP status
403 - Analyst observation The sandbox record is evidence about one historical group.wha.link page and generic runtime activity; it is not a current go.wha.link malware sample.
The parent domain is the operator and link-generation surface. A fresh supported scan reached it with HTTP 200 and did not identify a current harmful behavior signal, while repeated direct desktop and mobile requests during the later manual check returned HTTP 502 without an off-site redirect or payload. A public search snapshot from the previous day described phone-number and message inputs for creating WhatsApp links. The intermittent root availability does not establish malicious behavior and also prevents a complete current generator-flow test.
- Public artifact URL https://wha.link/
-
HTTP status
200 -
HTTP status
502 - Analyst observation The root was unavailable to two direct browser-like profiles during the final manual pass; no state-changing link-generation request was sent.
The exact host and parent resolved through Cloudflare. The exact host presented a currently valid Google Trust Services certificate for go.wha.link. Both hosts published SPF -all; the parent published a null MX record and strict reject DMARC policy. These records reduce unauthorized email use of the namespace, but they do not prove the safety of every hosted short code or WhatsApp group.
- DNS fact go.wha.link A 104.26.10.42, 104.26.11.42, and 172.67.68.127
- DNS fact go.wha.link TXT v=spf1 -all
- DNS fact wha.link MX 0 .
- DNS fact _dmarc.wha.link publishes p=reject, sp=reject, adkim=s, and aspf=s
- Certificate fact Google Trust Services WE1 certificate for go.wha.link, valid from 2026-07-23T20:15:55Z through 2026-10-21T21:15:53Z.
go.wha.link contains user-created short codes for WhatsApp chats, groups, or channels. The reviewed live object, archived objects, and public scan sample did not reproduce arbitrary third-party web navigation or malicious delivery, but the complete current and future code namespace is not publicly enumerable. Gridinsoft also cannot assess the content and conduct inside every destination WhatsApp conversation from the short-link page alone.
- Analyst observation A clean operator surface and finite clean sample cannot certify every existing or future user-created short code.
- Analyst observation Future abuse reports require the exact short-code URL and destination-specific evidence.
Scope and limitations
- The review covered the current Gridinsoft result, one active exact short code, five public scan screenshots, two retrievable archived exact-host objects, the parent operator surface, DNS, TLS, and the identified historical sandbox record.
- The complete current and future short-code namespace is not publicly enumerable, and private or deleted objects were not accessed.
- The parent generator root returned HTTP 502 to the final direct desktop and mobile checks, so no new link was created and the complete current generation request was not submitted.
- The review can inspect navigation from the short-link page but cannot certify messages, participants, or conduct inside every destination WhatsApp chat, group, or channel.
- Public URLhaus and ThreatFox APIs required authorization, OTX did not respond within the bounded request, and the public VirusTotal pages were not retrievable without an interactive session. These unavailable sources were not treated as clean results.
- Residual external domain labels remain independently controlled context and are not equivalent to a reproducible current malicious URL or payload.
Help protect others by sharing this page on social media! The more people who know about go.wha.link, the fewer chances they have to deceive someone else. Help others evaluate go.wha.link by sharing this page on social media!