web[.]redwhatsapp[.]com

Analysis of web.redwhatsapp.com shows that the domain was registered on May 21 2023 through NameSilo, LLC and resolves to the Cloudflare address 188.114.97.3, an IP owned by AS13335 Cloudflare, Inc. in the United States. The authoritative name servers are ali.ns.cloudflare.com and sean.ns.cloudflare.com, indicating the domain is hosted behind Cloudflare’s CDN. No TLS certificate is presented, meaning the site is served over plain HTTP. The page title retrieved from the live capture reads “RedWhatsApp - Download the Ultimate Collection of Free WhatsApp, Instagram, Telegram, Twitter, Snapchat, Tiktok, and Youtube Mods at RedWhatsApp.com!” which explicitly mentions Instagram among a list of other social platforms. The intelligence tags the activity as a social‑media phishing campaign that impersonates Instagram.

VirusTotal has recorded 13 of 93 scanning engines flagging the domain, confirming malicious classification by a subset of vendors. The domain appears on a single public blocklist and is listed as blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The current operational status is offline, but historical evidence suggests the site previously hosted phishing content targeting Instagram users. Uncertainty remains regarding the exact payload delivered to victims because the page content has not been captured beyond the title, and no SSL/TLS handshake data is available.

The lack of a certificate also prevents assessment of certificate‑based spoofing techniques. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any resurgence of activity from the same IP or hosting provider, and add the domain to internal threat intelligence feeds. Because the domain leverages Cloudflare’s infrastructure, future malicious sites may reuse the same name servers, so rule sets should consider the name‑server pattern in addition to the specific host name.