orange603.wd882.xyz
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Quttera Web Malware Removal is a paid subscription service. Pricing, plans, and trial availability are set by Quttera. Quttera is operated by Quttera Ltd, an independent third-party company unrelated to RCS LT. PCRisk.com may earn a referral commission when users sign up through this link.
Description of orange603.wd882.xyz
This domain appears to host a promotional landing page themed around the 2026 FIFA World Cup and branded as an Orange Money offer promising 10,000 FCFA. Based on the page title, screenshot, and linked resources, the site presents itself as a prize or giveaway campaign aimed at French-speaking users, likely in an African market where Orange Money is a recognized mobile payment brand.
The domain name itself does not appear to match an official Orange-owned web property and instead uses a random-looking subdomain on a low-recognition .xyz domain. The page structure and messaging suggest it may be designed to attract users with a time-sensitive reward or contest-style offer rather than provide a full corporate service portal. No clear evidence in the provided data identifies the actual operator of the site.
Safety Assessment for orange603.wd882.xyz
This website shows multiple risk indicators at the time of this scan. It was flagged by 13 out of 91 security engines, with many of those detections classifying the page as phishing or malicious. The page content also appears to imitate Orange Money branding while offering a World Cup-themed cash reward, which may be consistent with credential harvesting, promotional fraud, or other social-engineering activity. In addition, the malware scan flagged several site paths and an external script/domain as suspicious or malicious.
Blacklist and reputation data were mixed rather than fully clean. Major content-malice databases in the provided results did not list the domain at the time of this scan, but the domain's IP address was listed on one mail-reputation blocklist, which is a weaker signal and does not by itself prove harmful website content. Even so, the combination of multi-engine phishing detections, a very new domain, lack of traffic ranking, and branding that appears to mimic a known financial service materially increases concern.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The domain is relatively new, registered about 104 days before this scan, and uses Cloudflare nameservers and hosting infrastructure with a valid Let's Encrypt SSL certificate. HTTPS availability is a positive baseline feature, but it should not be treated as proof of legitimacy. DNSSEC appears to be unsigned, which means DNS responses may not benefit from that additional integrity layer.
The site is served through Cloudflare on IP address 188.114.97.0, with the server location reported as Toronto, Canada. The scan also identified suspicious activity involving local PHP paths and an external script loaded from another domain. That kind of external dependency can increase risk, especially when the linked resource is itself flagged during scanning.
Share your experience with this website. Was it safe? Did you encounter any issues?