omni[.]vaariational[.]io

Analysis of omni.vaariational.io as of July 19, 2026 indicates the domain is currently active and serving a page titled “Just a moment…”. The site returns an HTTP 301 redirect and presents a TLS certificate issued by Google Trust Services under the WE1 root, suggesting the use of a legitimate certificate authority to increase trust. Infrastructure inspection shows the domain resolves to IP address 188.114.97.3, which is owned by CloudFlare, Inc. and geolocated to Canada. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal reports that 4 of 91 security vendors have flagged the domain, reinforcing the suspicion of malicious use. No additional content, payload, or victim targeting details have been observed; the specific phishing campaign or lure remains undefined beyond the generic classification. Defenders should add the domain to network‑level deny lists, enforce DNS filtering, and monitor outbound connections to the resolved IP. Continuous re‑scanning with multi‑engine services is advised to capture any change in detection rates, and threat‑intel teams should consider correlating activity logs for matches against the IP address or TLS fingerprint.