dataplans[.]com[.]ng

PhishDestroy identifies dataplans.com.ng as an active brand phishing domain posing as a legitimate Nigerian telecom plan provider. The infrastructure mimics official mobile data plan portals to harvest subscriber credentials under the guise of plan upgrades or billing verification. No documented drainter kit association captured in open intelligence, suggesting a lightweight but persistent credential harvesting campaign against local telco users.

Technical indicators reveal negligible initial detection: VirusTotal flags 7 out of 95 engines, indicating fresh deployment. The domain resolves to ASN 37282 via IP 163.61.188.5, a Let’s Encrypt SSL certificate secures the endpoint, while WHOIS data remains unverified. The .com.ng namespace suggests targeting of Nigerian entities; however, registrar and creation timestamps remain obscured by privacy protections, complicating historical attribution. Google Safe Browsing shows no current categorization, and public blocklists currently hold zero entries against this subset.

This domain is marked active under investigation with an elevated investigative status. No active takedown has occurred; interim mitigation involves domain reputation tagging and IP-based network filtering. Users should avoid interacting with unsolicited links referencing data plan upgrades or billing alerts, especially those arriving via SMS or email. Remaining risk is classified as under_investigation due to low detection coverage and possible continued evolution of lures. Organisations are advised to monitor for login attempts from this IP and update SIEM rules accordingly.