omni[.]vafiational[.]io

Analysis indicates that the domain omni.vafiational.io is currently active and flagged as a high-risk generic phishing threat. The domain resolves to the IP address 172.67.134.213, which is geolocated in Canada and associated with Cloudflare, Inc. infrastructure. At the time of assessment on July 19, 2026, the domain is blocked by at least one security vendor, PhishDestroy, and appears on one security blocklist. The HTTP response status is a 301 redirect, suggesting the site may be attempting to forward visitors to another location, though the destination remains unconfirmed. The page title observed is 'Just a moment...', which is consistent with Cloudflare interstitial pages but may also indicate an attempt to obscure malicious activity. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority, which does not inherently indicate malicious intent but is frequently used by both legitimate and fraudulent sites. According to VirusTotal, six of ninety-one security vendors flag this domain as malicious, providing additional evidence of its suspicious nature. The domain's exact content and target brand have not been fully analysed, and no specific phishing kit or impersonated entity has been identified in the available data. Defenders are advised to treat omni.vafiational.io as an active phishing threat. Network-level blocking of the IP 172.67.134.213 and domain-level filtering are recommended to mitigate potential exposure. Further investigation into the redirect destination and any associated infrastructure is warranted to determine the full scope of the campaign. Given the domain's presence on security blocklists and detection by multiple vendors, organisations should prioritise monitoring and response actions.