I'm not sure that this is how it works in practice, but ideally: Unless you are registered in their stance / are browsing directly in their website, your client shouldn't be making any direct requisitions to their instance, so there is nothing they can infer your IP from. (Everything you interact with is comes directly your instance - the only thing that interacts with other instances is the server) That said, it's possible for some links to direct to the original stance, in which case your client will have to make requests directly to the original instance hosting the content... looking around in this page a bit, it looks like the Community images (banner, icon etc.) are linking directly to the original instance, so I guess that's a little bit of a problem - but just that shouldn't be enough information for them to connect the dots between the IP address fetching the image and the account you're using to browse

Por que startup em particular? Não são só startsups que estão fazendo demissões em massa - até 'Big Tech' vem fazendo recentemente

Mais do que somente o WhatsApp, esse tipo de golpe é mais velho do que o WhatsApp, e tem até nome - https://en.wikipedia.org/wiki/Typosquatting Tem que tomar cuidado com qualquer site que for digitar diretamente, não so o WhatsApp. Pessoalmente eu até recomendaria tacar no Google para pegar o link ao invés de digitar diretamente, se não puder favoritar o site ou copiar e colar o URL