omgomg[.]cc

The domain omgomg.cc has been confirmed as an active credential-harvesting site designed to deceive users into surrendering sensitive login credentials under the guise of a legitimate service. Based on telemetry and sandbox analysis, this domain employs social engineering tactics to mimic trusted platforms, tricking victims into inputting personal or financial information. The threat actor behind this operation leverages urgency and impersonation to maximize victim engagement, making it a high-risk domain for unsuspecting users.

Technical indicators for omgomg.cc confirm its malicious intent and operational footprint. PhishDestroy identifies this domain as a generic phishing endpoint, with VirusTotal flagging it at 7/95 detection engines as of the analysis seed 910447. The domain resolves to IP address 172.67.202.129 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 04, 2022. Notably, the domain holds a Google Trust Services SSL certificate, increasing its appearance of legitimacy. It has also been listed on one security blocklist and remains active despite detection efforts.

As of the latest assessment, omgomg.cc is categorized under an elevated risk level and continues to operate with active threat status. Response actions have included blocking by PhishDestroy and partial coverage from security vendors, though the domain remains accessible to users. The presence of a valid SSL certificate and relatively low blocklist coverage suggests ongoing evasion tactics. Users are strongly advised to avoid interacting with this domain, verify URLs before inputting credentials, and report any encounters to their security teams or trusted threat intelligence platforms. While current defenses have mitigated exposure in some environments, the risk of credential theft persists for unprotected users.