ico-omnera[.]xyz

This report details the investigation of the domain ico-omnera.xyz, which has been identified as a phishing infrastructure. The domain was registered through NiceNIC International Group Co., Limited on February 21, 2026. Analysis indicates that the domain has been flagged by several security vendors, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, and appears on four security blocklists. This suggests that the domain has been involved in malicious activities that warrant attention from security teams and defenders. The domain resolves to the IP address 172.67.187.135, which is located in the United States and is part of Cloudflare, Inc.'s network (AS13335).

The domain uses Cloudflare for DNS management, with nameservers jen.ns.cloudflare.com and oswald.ns.cloudflare.com. The SSL certificate for the domain is issued by Google Trust Services, indicating a level of trust in the certificate authority, but not necessarily in the domain itself. The domain supports HTTP/3, a modern protocol that may be used to enhance performance and potentially evade certain types of detection. As of the report date (July 23, 2026), the domain is currently offline, which could be a result of takedown efforts or a temporary pause in malicious activities.

The page title 'Omnera Points' suggests that the domain may have been used to mimic a legitimate service or brand, although the exact nature of the phishing content has not been fully analyzed. Defenders should be cautious and monitor for any signs of the domain coming back online. They should also ensure that their systems are configured to block known phishing domains and educate users about the risks of clicking on suspicious links. The limited availability of the domain and its presence on multiple blocklists indicate a need for ongoing vigilance to prevent potential future attacks.