omni[.]variatiional[.]io

The domain omni.variatiional.io is currently active and has been classified as a generic phishing site. HTTP requests to the domain receive a 301 redirect and the page title returned is "Just a moment...". The infrastructure resolves to the Cloudflare‑hosted IP address 104.21.85.86, which is geolocated to Canada and presents an SSL certificate issued by Google Trust Services under the WE1 label. The domain appears on one public blocklist and is specifically blocked by PhishDestroy. VirusTotal analysis shows that four of ninety‑one scanned security vendors flagged the domain, indicating a non‑trivial detection rate. While the page content beyond the title has not been publicly disclosed, the presence of a generic phishing classification, active status, and multiple vendor detections suggest malicious intent. Uncertainties remain regarding the exact payload or credential‑harvesting mechanisms employed, as no detailed page inspection is available. Defenders should add the domain to DNS and web‑filter blocklists, monitor for any outbound connections to the associated IP, and consider enforcing TLS inspection to capture any hidden redirects. Continuous re‑evaluation is advised, as additional detections may emerge if threat actors expand the campaign.