oogaboo[.]xyz

This domain, oogaboo.xyz, is identified as a fake login portal designed to harvest user credentials through phishing tactics. The page title 'Nur einen Moment…' suggests targeting German-speaking users, likely impersonating a legitimate service to trick victims into submitting login details, payment information, or other sensitive data. Analysis of the domain’s infrastructure indicates it may be part of a broader credential theft campaign, with potential secondary objectives such as malware distribution or follow-up social engineering attacks. Infrastructure analysis reveals the domain was registered on July 21, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.57.237 and is currently flagged by 3 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, and its status is marked as offline, though this does not eliminate the risk of reactivation or reuse in future campaigns. The combination of a recent creation date, low detection rate, and use of a high-reputation registrar suggests an attempt to evade automated detection while maintaining operational flexibility. Users who visited oogaboo.xyz should assume their credentials or other submitted data may have been compromised. Immediate actions include changing passwords for any accounts accessed while the domain was active, enabling multi-factor authentication where available, and monitoring financial statements for unauthorized transactions. If browser-based interactions occurred, clearing cached data and running a full antivirus scan is recommended to detect potential malware or tracking scripts. Organizations should block the domain and its resolving IP at the network level to prevent further exposure. Given the domain’s recent registration and low detection rate, heightened vigilance is advised for similar phishing attempts using newly registered domains or German-language lures.