# PhishDestroy domain threat record: omgomg.store

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/omgomg.store/
Machine-readable companion: https://phishdestroy.io/domain/omgomg.store/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-25 05:57:19 UTC
- Last availability or vendor check: 2026-10-21 22:32:51 UTC
- Stored record updated: 2026-10-22 14:23:37 UTC
- VirusTotal detections in the stored snapshot: 4/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registration date (registry RDAP, omgomg.store): 2026-07-11 11:11:34 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d722-6dee-73be-9bbe-b4dfea1ac602/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/omgomg.store
- Certificate Transparency search: https://crt.sh/?q=%25.omgomg.store
- Web Archive lookup: https://web.archive.org/web/*/https://omgomg.store/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
omgomg.store is an impersonation phishing page: a site built to pass itself off as a legitimate service so visitors trust it with their credentials or money. PhishDestroy first saw it on 2026-09-25. Its page title showed only "omgomg" and did not name the brand it imitated, but we classified it as impersonation phishing. The site went offline on 2026-10-14 and was still dead when last checked on 2026-10-19.

How the scam works
Impersonation pages copy the look and wording of a service the victim already uses, then present a login form, account "verification" step or payment prompt. Anything typed in goes to the operators. Stolen passwords and one-time codes are used to take over the real account. Payments made on the fake site are simply kept. The bare "omgomg" title points to a short-lived throwaway domain rather than an established business.

Evidence
VirusTotal results from 2026-10-06 show 4 of 91 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker and Gridinsoft. That is a low count, so many browsers and security tools would have shown no warning to visitors. The domain also appears in 8 AlienVault OTX threat pulses, which means other researchers tracked it independently. PhishDestroy is the only blocklist listing it.

Infrastructure
The domain resolved to an address on Cloudflare's network, geolocated to Canada. That means the real origin server sat behind Cloudflare's proxy and was not exposed. Its TLS certificate came from Google Trust Services (WE1), the standard certificate for Cloudflare-fronted sites. The padlock in the browser therefore said nothing about whether the site was legitimate. The site ran for roughly three weeks after we first saw it before going dark.

What to do
If you entered a password on omgomg.store, change it on the genuine service and on any account that uses the same password. Then turn on app-based two-factor authentication and sign out of all active sessions. If you gave a one-time code or recovery phrase, treat that account as compromised and move any funds it controls. If you paid through the site, contact your bank or card issuer immediately to dispute the charge. Security teams should block the domain, search proxy and DNS logs for visits since 2026-09-25, and reset credentials for any users who reached it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d722-6dee-73be-9bbe-b4dfea1ac602/
VirusTotal report: https://www.virustotal.com/gui/domain/omgomg.store
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=omgomg.store
Archived copy: https://web.archive.org/web/20260925064954/https://omgomg.store/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:44 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/ns62G4gn/4532f9c3be24.png
  Captured: 2026-09-25 05:57:19 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0d722-6dee-73be-9bbe-b4dfea1ac602.png
  Captured: 2026-09-25 05:57:19 UTC
  Source report: https://urlscan.io/result/01a0d722-6dee-73be-9bbe-b4dfea1ac602/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5fe06fc5-babe-4c13-8e05-d1678bab3c0a.png
  Captured: 2026-09-25 06:30:17 UTC
  Source report: https://radar.cloudflare.com/scan/5fe06fc5-babe-4c13-8e05-d1678bab3c0a
  SHA-256: bd5be6a7c075c8748b6112c074dfbeb2efb9cacf209893c5d0d06b27f41a5165
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d73b-3d79-75ed-8d59-d586ff2dce0b.png
  Captured: 2026-09-25 06:23:04 UTC
  Source report: https://urlscan.io/result/01a0d73b-3d79-75ed-8d59-d586ff2dce0b/
  SHA-256: d632da01e88d69f65535fd02cfbaa218c121cefd07113886924e077636f73333

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:58:22Z",
        "uuid": "01a0d722-6dee-73be-9bbe-b4dfea1ac602",
        "scanned_at": "2026-09-25T05:55:59Z",
        "final_url": "https://omgomg.store/",
        "status": 200,
        "ip": "104.21.16.165",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.80.73",
            "104.21.16.165"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "9312c4f6001eead66eafdf6f1cc5447ed17525b2dd72a94b8d7b673faa7062ef",
        "globals": [
            "requestResize",
            "__cfBeacon"
        ],
        "cookies": [
            "antibot"
        ],
        "tls": {
            "san": [
                "omgomg.store",
                "*.omgomg.store"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "omgomg.store",
            "protocol": "TLS 1.2",
            "valid_to": "2026-12-09T18:12:07Z",
            "valid_from": "2026-09-10T17:12:11Z"
        },
        "domain_age_days": 1526,
        "apex_age_days": 1526,
        "tls_age_days": 14,
        "tls_valid_days": 90,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:05:54Z",
        "uuid": "5fe06fc5-babe-4c13-8e05-d1678bab3c0a",
        "scanned_at": "2026-09-25T06:30:17Z",
        "final_url": "https://omgomg.store/",
        "status": 200,
        "history": [
            {
                "url": "https://omgomg.store/",
                "status": 200
            }
        ],
        "dom_hash": "39a29eb19730275131d844181f4dfbca198b429e35cd6fe7383e0d8cb6eae35f",
        "doc_hash": "4b070735e244b1b51c8c706b7deff3223eb1ad691975f35099701e62660455c9",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "omgomg.store",
                "type": "A",
                "value": "172.67.214.219"
            },
            {
                "name": "omgomg.store",
                "type": "A",
                "value": "104.21.16.165"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.214.219",
        "whois": {
            "registrar": "Fewmoretaps OU d/b/a Trustname.com",
            "created": "2026-07-11T11:11:34Z",
            "updated": "2026-07-16T11:12:31Z",
            "expires": "2027-07-11T11:11:34Z",
            "nameservers": [
                "beau.ns.cloudflare.com",
                "dee.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T18:09:14Z",
        "analysis_at": "2026-10-07T21:15:03Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Business/Economy, Suspicious (alphaMountain.ai)"
        },
        "popularity": {
            "Majestic": 998129,
            "Cisco Umbrella": 395846
        },
        "created": "2026-07-06T00:00:00Z",
        "updated": "2026-07-06T00:00:00Z",
        "first_seen": "2023-10-22T10:05:49Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.214.219"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.16.165"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dee.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "beau.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "beau.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-09-26T03:55:04Z",
        "jarm": "27d40d40d00040d1dc27d40d27d40d5fb4c89fe3813d172ffb53f84a68f750",
        "cert": {
            "san": [
                "omgomg.store",
                "*.omgomg.store"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "64c127390f984a8e0e1974c806a70977",
            "sha256": "8776b9414f5df3fe0d0da835058955c12982f087e5fd765f550cccf8908f581d",
            "subject": "omgomg.store",
            "valid_to": "2026-12-09T18:12:07Z",
            "valid_from": "2026-09-10T17:12:11Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-07-11T11:11:34Z",
                "last changed": "2026-07-13T13:54:59Z",
                "registration": "2026-07-11T11:11:34Z",
                "registrar expiration": "2027-07-11T11:11:34Z",
                "last update of RDAP database": "2026-10-01T01:59:37Z"
            },
            "registrar": "Fewmoretaps OU d/b/a Trustname.com",
            "registrar_iana_id": "4318"
        }
    }
}
```