omni[.]avriational[.]io

Analysis of omni.avriational.io, observed on 21 July 2026, identifies the domain as an active high‑risk generic phishing site. The hostname resolves to 104.21.25.247, an address owned by Cloudflare, Inc. and geolocated to California. The web server presents a Cloudflare‑issued SSL certificate signed by Google Trust Services under the WE1 root, indicating encrypted HTTPS traffic. HTTP responses are issued as a 301 redirect, and the final page title returned is “Just a moment…”. Detected technologies include Cloudflare Browser Insights, the core Cloudflare service, and HTTP/3, consistent with typical Cloudflare‑protected infrastructure.

VirusTotal scans show four of ninety‑one security vendors flagging the domain, and the site appears on a single external blocklist that currently lists PhishDestroy as a blocking entity. The presence of a Cloudflare front end does not mitigate the phishing risk; it is commonly used by threat actors to hide origin and benefit from performance features. Evidence confirms the domain is currently active and classified as generic phishing, but the specific payload, credential‑stealing pages, or target brands have not been disclosed in the available data. Consequently, the exact attack vector and victim profile remain uncertain.

Defenders should treat any traffic to omni.avriational.io as malicious. Recommend adding the hostname to network‑level deny lists, updating web‑filtering rules, and monitoring for outbound connections to the underlying IP address. Continuous re‑scanning with VirusTotal and similar services is advised, as additional detections may emerge. Organizations using Cloudflare‑based security controls should ensure that URL‑filtering policies are configured to block the domain regardless of the underlying CDN provider.