omni[.]vraiational[.]io

Analysis of omni.vraiational.io indicates a high-risk phishing domain currently active as of July 19, 2026. The domain resolves to IP address 188.114.97.3, which is geolocated in Canada and operated by Cloudflare, Inc. The observed HTTP status is 301 (permanent redirect), and the page title captured is 'Just a moment...', a common placeholder used by Cloudflare during initial request handling or when automated checks are enforced. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate malicious intent but is consistent with infrastructure used by both legitimate and fraudulent sites. Four out of 91 security vendors on VirusTotal have flagged this domain, and it appears on at least one security blocklist, including PhishDestroy. While the exact phishing target or brand impersonation is not confirmed in available data, the combination of a 301 redirect, Cloudflare hosting, and detection by multiple security tools suggests infrastructure commonly associated with credential harvesting or redirect-based phishing campaigns. Defenders should treat this domain as active and malicious, particularly if observed in network logs, email links, or third-party referrals. No evidence of takedown or mitigation is present, and the domain remains operational. Further analysis of redirect chains or payload delivery would be required to determine the specific threat vector, but current indicators justify immediate blocking and investigation.