omgheroes[.]com

Analysis of omgheroes.com, observed as a generic phishing site, indicates that the domain was registered on March 06, 2026 through NiceNIC International Group Co., Limited and immediately pointed to the IP address 188.114.97.3, which belongs to Cloudflare’s AS13335 network in the United States. The domain is served without an SSL certificate, and its authoritative name servers are athena.ns.cloudflare.com and charles.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The public page title returned by the site is "OMG!OMG!", and the site has been taken offline, as reflected in the current status indicator.

Threat intelligence sources have flagged the domain: PhishDestroy has listed it as blocked, a single security blocklist also contains the domain, and VirusTotal reports that one of ninety‑four scanning engines flagged it as malicious. No additional detection vendors or safe‑browsing signals are provided, and the absence of further corroborating evidence leaves the full scope of the phishing campaign uncertain. Defenders should prioritize adding the domain to internal block lists, monitor for any residual traffic to 188.114.97.3, and enforce TLS inspection policies to detect attempts to reach the site before it was taken down.

Given the Cloudflare hosting, any future re‑use of the same IP address by unrelated services may generate false positives; correlation with the specific page title and the known registrar record is recommended to reduce collateral impact. Continuous observation of the domain’s registration status and any re‑appearance in threat feeds is advised, as the rapid creation date suggests a short‑lived malicious operation that may be replicated with similar naming patterns.