oumechrwq[.]com

PhishDestroy identifies oumechrwq.com as an active generic phishing domain posing an elevated credential theft risk to users. The infrastructure is currently live and operational, actively harvesting credentials under the guise of a legitimate service.

This domain was flagged by PhishDestroy on seed 1770ac. Intelligence shows it resolves to IP address 159.100.6.19 and is served via an SSL certificate issued by Let's Encrypt, giving it a false veneer of legitimacy. VirusTotal scanning reveals only 1 out of 95 security vendors currently detects this threat, indicating poor early-stage detection coverage. It was registered through Ultahost, Inc., and the domain creation date is May 15, 2026—an unusually recent timestamp suggesting a hastily deployed campaign. Despite its newness, the domain shows signs of active use in phishing lures, likely targeting unsuspecting users via email or social engineering.

Due to the elevated risk and poor detection rates, users should immediately block access to oumechrwq.com at the network and endpoint levels. Enterprises are advised to update DNS blocklists and firewall rules, and to initiate a password reset cycle for any accounts that may have been accessed from devices connecting to this domain. Staff should be reminded of red flags such as recently registered domains and low VirusTotal detection rates. If exposure is suspected, enable multi-factor authentication and audit account activity for anomalies. Proactive blocking of IP 159.100.6.19 and the domain itself is strongly recommended to prevent further compromise.