k901zx[.]webwave[.]dev

Analysis indicates that k901zx.webwave.dev is an active web resource that currently presents a page titled “Mobilenotes01 » Home” and purports to impersonate the Orange brand. The site is reachable over HTTPS with a valid Let’s Encrypt (E7) certificate, which alone does not attest to legitimacy. The domain resolves to IP 185.73.228.142, which is registered to the Polish AS20853 (eTOP sp. z o.o.) and was created on 2019‑03‑01 through Key‑Systems GmbH. The hosting environment reports Apache HTTP Server with HTTP Strict Transport Security enabled, and the authoritative nameservers are ns1.webwavecms.com and ns2.webwavecms.com.

Reputation data shows the domain appears on two public phishing blocklists (PhishDestroy and PhishingDB) and has been flagged by 16 of 95 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. An HTTP GET returns a 200 status code, confirming that the site is actively serving content.

The current intelligence does not include a detailed content analysis of the landing page, so the exact tactics used to lure victims (e.g., credential capture forms) remain unverified. However, the combination of brand impersonation, low trust score, blocklist presence, and the “Mobilenotes01” title suggests a deliberate attempt to deceive users familiar with Orange services.

Defenders should add k901zx.webwave.dev and its resolved IP 185.73.228.142 to network and email filtering blocklists, monitor DNS queries for the domain, and enforce URL reputation checks on outbound traffic. Continuous monitoring of the associated AS20853 range is advised, as the infrastructure may be reused for additional malicious campaigns. Updating endpoint security signatures to reflect the 16 vendor detections will help mitigate exposure.