vomp[.]ng

This domain is flagged for hosting credential harvesting phishing infrastructure, posing an elevated risk to users. Analysis indicates vomp.ng is designed to mimic legitimate login portals, tricking victims into submitting usernames, passwords, and other sensitive credentials. The threat type aligns with generic phishing but exhibits technical indicators of targeted credential theft, including the use of encrypted communication channels to evade detection. Infrastructure analysis reveals the domain was registered on June 06, 2024, through Leads Globe, a registrar frequently associated with high-risk domains. It resolves to the IP address 163.61.188.5, located in the United States (MIT). The domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports 13 out of 95 security vendors flagging vomp.ng as malicious. The SSL certificate is issued by Let's Encrypt (R13), a common tactic to lend false legitimacy to phishing sites. Current status indicates the domain has been taken offline, though historical resolution data confirms its prior operational state. Mitigation steps for organizations and users include immediate blocking of the domain and its resolving IP (163.61.188.5) at the network perimeter. Security teams should review logs for connections to vomp.ng or its IP address to identify potential compromised credentials. Users who may have interacted with the domain should reset passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. Domain monitoring tools should be configured to alert on re-registration or DNS changes for vomp.ng, as threat actors often re-deploy phishing infrastructure under the same or similar names.