omni[.]variatioal[.]io

Analysis of omni.variatioal.io shows it is an active generic phishing infrastructure. The domain resolves to the Cloudflare‑owned IP address 188.114.97.3, which geolocates to California, United States. HTTP requests receive a 301 redirect and the page title returned is "Just a moment...". The TLS certificate is issued by Google Trust Services under the WE1 name, indicating a valid, publicly trusted certificate. VirusTotal records indicate that four of ninety‑one scanning engines have flagged the domain, and it is presently listed on one external blocklist. The site is also blocked by the PhishDestroy feed, confirming its malicious intent. While the exact phishing lure (e.g., credential‑stealing page) has not been disclosed, the presence of a generic title and redirection behavior is consistent with credential‑harvesting campaigns. Defenders should block outbound connections to 188.114.97.3, add omni.variatioal.io to URL filtering and DNS sinkhole policies, and monitor logs for any HTTP 301 activity targeting this domain. Continuous re‑evaluation is advised, as additional indicators may emerge if the payload evolves.