omni-tools[.]vip

This domain, omni-tools.vip, was registered on 2026-05-05 through Cloudflare, Inc. and resolves to the Cloudflare‑provided address 172.67.190.193, which is geolocated to Canada. The authoritative nameservers are emerson.ns.cloudflare.com and mira.ns.cloudflare.com. The site returns HTTP 200 over TLS with a Let’s Encrypt certificate (E7) and advertises the page title “Omni | Universal Toolkit”. Automated analysis identifies a stack consisting of Node.js, Express, Proton Mail integration, Cloudflare Browser Insights and HTTP/3 support. The domain is currently listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask and SEAL. VirusTotal records show five of ninety‑one scanners flagging the host, contributing to a high risk rating and a Gridinsoft trust score of 0 / 100. The infrastructure indicates use of Cloudflare’s CDN and DNS services, which obscures the underlying hosting environment. No additional payload or credential‑harvesting mechanisms have been publicly disclosed, and the exact phishing lure remains unconfirmed beyond the generic classification. Defenders should treat any traffic to omni-tools.vip as malicious, enforce outbound filtering, and consider adding the domain to internal blocklists. Monitoring for new detections on threat‑intel feeds and re‑evaluating the site if additional indicators emerge is recommended.