onesignal[.]mwmze[.]com

The domain onesignal.mwmze.com is currently active and represents a fresh phishing threat. It was registered with GoDaddy.com, LLC and is hosted on the IP address 188.114.96.3. Despite being undetected by any of the 95 antivirus engines on VirusTotal, this domain exploits the critical 24-72 hour window between its registration and the propagation of detection signatures across antivirus databases. This gap allows phishing domains to operate undetected for a short period, making early detection crucial.

PhishDestroy identified onesignal.mwmze.com on June 22, 2026, highlighting its ability to catch threats in this pre-propagation phase. The domain's lack of VirusTotal detections is not indicative of safety but rather its novelty and the timing of its identification. By catching such domains early, PhishDestroy provides an essential layer of protection against emerging threats.

Given the domain's recent creation on November 4, 2024, and its current active status, it is likely part of a broader phishing campaign. The use of a recognizable name like "onesignal" suggests an attempt to deceive users by mimicking legitimate services. This tactic is common in phishing schemes, aiming to harvest sensitive information from unsuspecting users. As the domain remains active, ongoing vigilance and rapid response to such threats are imperative to mitigate potential damage.