oumarketio[.]com

PhishDestroy identifies active phishing infrastructure at oumarketio.com, masquerading as a legitimate online marketplace to harvest user credentials and payment details. This domain currently operates with a status of 'under_investigation' but remains actively engaged in malicious activity. The threat type has been classified as 'generic_phishing,' indicating a broad but deliberate impersonation strategy targeting users under the guise of a retail platform.

This domain was flagged by 13 of 95 VirusTotal security vendors at the time of assessment, exhibiting a high evasion rate. The domain oumarketio.com is registered through Dynadot Inc and resolves to the IP address 54.215.31.113, which is associated with suspicious traffic patterns. The domain was created on October 02, 2025, and is secured with a Let’s Encrypt SSL certificate, adding a superficial layer of legitimacy. The IP address does not appear on prominent threat intelligence blocklists at this time, though this may change as further analysis is conducted. The domain’s recent registration and current lack of detection underscore the need for immediate scrutiny.

Given the active status of this campaign and the absence of vendor detection, PhishDestroy recommends immediate action to mitigate risk. Organizations and end users should block oumarketio.com at the network and DNS levels. Further, inspect any recent communications referencing this domain or similar marketplace domains for indicators of compromise. Enhanced monitoring of the associated IP address 54.215.31.113 and related infrastructure is advised due to its potential for ongoing malicious use. Users who may have interacted with this domain are urged to revoke any shared credentials immediately and monitor financial accounts for unauthorized activity.