app[.]otp-mania[.]com

PhishDestroy identifies app.otp-mania.com as an active generic_phishing domain designed to harvest one-time passwords (OTP) under the guise of a login interface. The threat type is OTP theft via a fake authentication page, commonly used to bypass two-factor authentication and drain cryptocurrency wallets. While no specific drainer kit has been linked yet, the domain structure and naming suggest a deliberate mimicry of legitimate OTP systems, likely targeting users expecting SMS or app-based OTP prompts.

This domain was flagged on January 15, 2024, and resolves to IP 104.21.30.38 with a legitimate SSL certificate issued by Google Trust Services. The domain was registered through Spaceship, Inc., and currently shows 0 detections out of 95 scans on VirusTotal. Google Safe Browsing (GSB) has not yet classified the domain, and it remains unblocked by known threat intelligence feeds. No prior associations with malware loaders or phishing toolkits have been recorded in threat intelligence databases as of the latest scan.

The domain remains active and under investigation, with no immediate risk mitigation in place due to its low detection profile. PhishDestroy advises users to verify the domain through its threat intelligence platform before interacting with any OTP-related prompts. While the technical indicators suggest caution, the lack of broader blocklist inclusion and GSB classification indicates a developing threat requiring continued monitoring. Users are urged to report suspicious domains via PhishDestroy’s reporting tool to aid in rapid threat containment.