whatsapp-web-clone-omega[.]vercel[.]app

This domain, whatsapp-web-clone-omega.vercel.app, is specifically identified as a fake login site designed to steal user credentials and personal information. The threat involves a malicious attempt to mimic the legitimate WhatsApp Web interface, thereby tricking users into providing sensitive data such as usernames, passwords, and possibly two-factor authentication codes.

Analysis indicates that the domain has been flagged by 16 out of 95 security vendors on VirusTotal, a significant number that suggests a high likelihood of malicious activity. The domain is registered through Tucows Domains Inc., and it was created on February 21, 2026. The site appears on two security blocklists, further confirming its suspicious nature. The domain currently resolves to the IP address 64.29.17.67, which is located in the United States and is associated with Amazon.com, Inc. (AS16509). Despite the SSL certificate issued by Google Trust Services / WR1, the site's current status is listed as 'Deployment Unavailable,' which could be a tactic to evade detection or a sign that it has been taken down.

If users have visited this domain, they should immediately take steps to secure their accounts. This includes changing passwords for all related accounts, enabling two-factor authentication if not already in place, and monitoring account activity for any unauthorized transactions or changes. Users should also notify their respective security teams or IT departments about the visit and seek further guidance on potential security risks. It is recommended to avoid clicking on any links or entering personal information on unverified websites, especially those that mimic well-known services.