omnipool[.]top

Analysis of www.omnipool.top shows a domain created on 12 March 2026 and immediately pointed at the Cloudflare edge IP 188.114.97.3 (AS13335, United States). The domain uses Cloudflare’s DNS service (maisie.ns.cloudflare.com, tosana.ns.cloudflare.com) and presents the generic Cloudflare “Attention Required!” page title, indicating that the site is currently offline. The SSL certificate is issued by Google Trust Services under the WE1 root, which is a legitimate certificate authority and therefore does not imply trustworthiness of the hosted content. Registration was performed through Gname.com Pte. Ltd., a registrar commonly used for both legitimate and malicious registrations.

The domain is classified as a generic phishing campaign with a specific investment‑scam focus, and it has been listed by the PhishDestroy blocklist. VirusTotal records show that 13 of 91 security vendors have flagged the domain as malicious, and it appears on one additional security blocklist. Technologies detected include Cloudflare Browser Insights and the standard Cloudflare reverse‑proxy stack, which are often leveraged by threat actors to hide origin infrastructure. The combination of a recent registration date, use of a widely trusted CDN, a legitimate‑looking SSL certificate, and multiple vendor detections strongly suggests malicious intent despite the current offline status.

Uncertainty remains regarding the exact payload or phishing landing page, as no content has been captured. Defenders should continue to block the domain at network perimeter, monitor DNS queries for re‑registration, and consider adding the IP address to threat‑intel feeds. Ongoing observation of related Cloudflare‑protected domains registered through the same registrar may reveal a broader campaign.