point-omnera[.]xyz

The domain point-omnera.xyz has been identified as a fake account lockout phishing site designed to deceive users into disclosing credentials under the pretense of an account suspension. As of the latest verification, the domain has been marked as taken_down, though prior activity suggests it impersonated a generic login portal rather than a specific brand. The page title 'Account Suspended' was used to create urgency, a common tactic in credential harvesting campaigns. Analysis indicates the domain was flagged by 13 of 95 security vendors on VirusTotal, reflecting moderate to high confidence in its malicious nature. It was registered on November 21, 2025, through NiceNIC International Group Co., Limited, and resolved to the IP address 95.214.235.117, hosted on Autonomous System AS30860 (Virtual Systems LLC) in Ukraine. The domain appeared on two security blocklists and was actively blocked by at least two threat intelligence feeds. Notably, the infrastructure lacked an SSL certificate, a red flag for phishing sites aiming to avoid encryption-based scrutiny. Current status confirms the domain has been taken down, though residual risks may persist for users who interacted with it prior to deactivation. Organizations are advised to block the domain and its associated IP at the perimeter level, even post-takedown, to prevent potential residual connections. Users who may have entered credentials on this site should immediately reset passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. Network defenders should monitor for traffic to 95.214.235.117 and correlate logs for signs of prior compromise, particularly focusing on outbound connections to the IP during the domain's active period.