whatsapp-clone-32do[.]onrender[.]com

The domain whatsapp-clone-32do.onrender.com was observed on July 22, 2026 as an active generic phishing site. VirusTotal scans show that 19 of 91 security vendors have flagged the host, indicating a high detection consensus. The web server returns HTTP 200 and presents the page title “WhatsApp”, suggesting an attempt to lure victims by referencing the popular messaging service. The site is protected by an SSL certificate issued by Google Trust Services under the WE1 brand, which provides TLS encryption but does not attest to the legitimacy of the content. Infrastructure analysis reveals that the domain resolves to IP address 216.24.57.8, which belongs to AS397273 owned by Render and is located in the United States.

The hosting environment is identified as a Render service using Node.js, Express, and Cloudflare with HTTP/3 support. The registrar information indicates registration through Render Services Inc., and the nameserver query returned NS_NOT_FOUND, implying that standard DNS delegation records are absent or concealed. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed, confirming that at least one threat‑intel source has catalogued it as malicious. Current status remains active, meaning the phishing payload is still reachable. Uncertainties include the exact phishing workflow, credential‑stealing forms, and any additional malicious payloads, because no visual analysis or content inspection is available.

Defenders should prioritize adding the domain and its resolving IP to block lists at network perimeter and DNS filtering layers. Monitoring for new sightings in sandbox feeds and correlating any outbound connections to 216.24.57.8 with user activity is recommended. Because the SSL certificate is valid, traditional certificate‑based allowlists may not prevent access, so rule sets should rely on hostname and IP indicators rather than certificate trust.