omni[.]variationao[.]io

omni.variationao.io is currently listed as active in threat intelligence feeds as of July 19, 2026. The site returns an HTTP 301 redirect and presents the page title “Just a moment…”. DNS resolution points to 104.21.11.146, an address owned by Cloudflare, Inc. and located in Canada. The SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating the use of a standard public‑key infrastructure. The domain appears on a single security blocklist and has been flagged by the PhishDestroy blocklist provider. VirusTotal analysis shows that four of ninety‑one scanned scanners have generated detections for the domain, confirming that at least some security products consider it malicious. No additional context such as the targeted brand or specific phishing kit is available from the collected data. Because the infrastructure relies on a reputable content‑delivery network, typical network‑level blocking may generate false positives for unrelated legitimate traffic hosted on Cloudflare, so defenders should apply domain‑level controls rather than blanket IP blocks. Recommended mitigation steps include adding omni.variationao.io to deny lists in web proxies, DNS filtering solutions, and endpoint protection rules, and monitoring for any outbound connections to the resolved IP address. Continuous re‑evaluation is advised, as the threat actor could modify the payload or redirect to a different backend while retaining the same domain.