omnimusk[.]live

This domain, omnimusk.live, is flagged as a confirmed phishing site designed to harvest user credentials through a fake platform login portal. Analysis indicates no direct association with known cryptocurrency drainer kits or brand impersonation of legitimate services. The site presents itself as the 'Omnimusk Platform,' leveraging a fabricated interface to deceive users into submitting sensitive login information, which is then captured for malicious purposes.

Technical indicators reveal the domain was registered on May 10, 2026, through Global Domain Group LLC, an uncommon registrar for legitimate platforms. It resolves to the IP address 37.49.229.75 and is detected by 14 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. Infrastructure analysis shows the use of PHP, Tailwind CSS, LiteSpeed, Alpine.js, and content delivery via Unpkg and jsDelivr, with HTTP/3 protocol support, which may be employed to evade detection or enhance performance.

As of the latest assessment, the domain status is marked as taken_down, indicating successful disruption of its operational infrastructure. However, residual risk persists due to potential re-registration or migration of the phishing campaign to alternative domains. Organizations and users are advised to block the domain and its associated IP at the network perimeter, monitor for credential reuse attempts, and verify the legitimacy of any platform claiming association with 'Omnimusk' before interacting with it. Continuous threat intelligence monitoring is recommended to detect resurgence or evolution of this campaign.