wap[.]orangemoney[.]top

PhishDestroy identifies wap.orangemoney.top as a high-risk phishing domain impersonating Orange Money, a legitimate mobile money service. This domain leverages a web-based phishing kit designed to harvest user credentials and financial data under the guise of a legitimate Orange Money portal. The threat actor behind this campaign employs social engineering tactics to trick victims into entering sensitive information, including mobile numbers, passwords, and payment details, which are then exfiltrated to the attacker-controlled infrastructure. The domain's naming convention (wap.orangemoney.top) is strategically crafted to appear as an official Orange Money subdomain, likely distributed via SMS or messaging platforms to increase credibility among unsuspecting users.

This domain was flagged by PhishDestroy with a high-risk assessment, confirmed by 8 out of 95 security vendors on VirusTotal. The domain resolves to IP address 156.247.62.203 and was registered through Gname.com Pte. Ltd. on July 13, 2025. It has been blocked by OpenPhish and appears on one additional security blocklist. The domain’s recent creation date and low blocklist coverage indicate it is a newly deployed threat with high evasion potential.

As of the latest analysis, wap.orangemoney.top remains active and poses a significant risk to users who interact with it. While immediate takedown efforts have been initiated, the domain’s persistence suggests potential delays in mitigation. Users are strongly advised to avoid accessing this domain and to report any encounters to their security teams or relevant financial institutions. The remaining risk is high due to the domain’s active status, low blocklist coverage, and the ongoing threat of credential harvesting. Enhanced monitoring and user awareness campaigns are critical to mitigating this threat.