ooomoney[.]info

PhishDestroy identifies ooomoney.info as an active credential-harvesting domain that mimics legitimate financial-login portals to steal user credentials and personal data. This site is currently live and poses an immediate risk to visitors who may unknowingly enter sensitive account information. The threat actor behind this domain seeks to capture usernames, passwords, and possibly multi-factor authentication codes, which are then exfiltrated for fraudulent transactions or sold on underground markets. This domain was flagged with zero detections on VirusTotal out of 95 scanners, was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 05, 2026, and currently sits on no public blocklists. Its SSL certificate from Let’s Encrypt provides a false sense of legitimacy, masking its true purpose. The combination of recent registration date, clean scanning history, and hosting on a dedicated IP address suggests a rapidly deployed, low-profile operation aimed at evading detection in the early stages. If you or your organization have visited ooomoney.info, assume credentials entered were compromised and reset passwords immediately using a different device. Enable multi-factor authentication on all related accounts and scan local systems for malware or unauthorized access. Report the domain to your security team and block it at the network perimeter to prevent further exposure. Monitor financial accounts closely for irregular activity following any interaction with this site.