omni[.]variatilnal[.]io

Analysis of omni.variatilnal.io shows an active generic phishing operation. The domain resolves to the Cloudflare‑owned address 188.114.97.3 located in Canada, indicating the use of a reputable CDN to hide the true origin of the malicious server. HTTP requests receive a 301 redirect and the sole page title returned is "Just a moment...", which is typical of Cloudflare's interstitial challenge page and provides no insight into the payload or credential‑harvesting page hosted behind the redirect. The SSL certificate is issued by Google Trust Services under the WE1 name, confirming that TLS termination is performed by a legitimate Certificate Authority, further obscuring attribution. VirusTotal scans have flagged the domain on four of ninety‑one security engines, and the site appears on one external blocklist, demonstrating that independent security services have observed malicious activity. PhishDestroy has already classified the domain as a phishing threat, supporting the high‑risk rating. While the exact phishing lure, targeted brand, or credential‑stealing form is not observable from the available data, the infrastructure signals deliberate abuse of trusted services to increase delivery success. Defenders should immediately block omni.variatilnal.io at DNS and proxy layers, add the IP 188.114.97.3 to outbound filtering rules, and monitor for any connections that bypass these controls. Continuous threat‑intel sharing and periodic re‑scanning of the domain are recommended to capture any evolution in the payload or targeting.