omni[.]variatiohal[.]io

Analysis of omni.variatiohal.io indicates active generic phishing infrastructure as of July 19, 2026. The domain resolves to the Cloudflare IP address 188.114.97.3, located in Canada, and serves an SSL certificate issued by Google Trust Services under the WE1 designation. HTTP requests receive a 301 redirect, and the only observed page title is "Just a moment...". VirusTotal scans show that four of ninety‑one security vendors have flagged the domain, suggesting known malicious behavior. The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. While the redirect and title provide limited visibility into the payload, the combination of a Cloudflare‑hosted IP, a Google‑issued certificate, and multiple vendor detections supports a high‑risk classification. Uncertainty remains regarding the exact phishing content and target brand, as no additional page details have been captured. Defenders should add omni.variatiohal.io to URL filtering rules, monitor DNS queries for the associated IP, and consider broader threat‑intel sharing to ensure rapid containment.