3[.]omgpwa1[.]pw

The domain 3.omgpwa1.pw was first registered on December 11, 2024 through NiceNIC International Group Co., Limited. Its authoritative nameservers are cass.ns.cloudflare.com and mike.ns.cloudflare.com, indicating that the domain is hosted on the Cloudflare network (AS13335, United States). DNS resolution points to IP address 104.21.83.224, which is a Cloudflare edge node. No TLS certificate was presented when the site was queried, confirming the absence of HTTPS protection.

The page title returned by the HTTP response is "OMG!OMG!", but no further content analysis is available because the site has been taken offline at the time of this report. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, where it is listed as blocked by PhishDestroy. VirusTotal scans recorded two positive detections out of ninety‑five submitted security vendors, providing limited but corroborating evidence of malicious activity.

The combination of a newly created domain, Cloudflare front‑end, lack of SSL, low trust score, blocklist presence, and multiple vendor detections aligns with the classification of a generic phishing infrastructure. Uncertainty remains regarding the specific payload or credential‑harvesting mechanism due to the offline status and lack of page content. Defenders should add 3.omgpwa1.pw to URL filtering and DNS blocklists, monitor for any re‑hosting on alternative IPs, and consider threat‑intel sharing of the observed indicators (IP 104.21.83.224, nameservers, registration details) to pre‑empt potential reuse.