omni[.]variatiinal[.]io

Analysis of omni.variatiinal.io shows a high‑risk phishing infrastructure that is currently active. The domain resolves to the CloudFlare‑owned IP address 188.114.97.3, which is registered to CloudFlare, Inc. in Canada. An HTTPS endpoint presents a Google Trust Services / WE1 certificate, indicating the use of a legitimate certificate authority to increase perceived legitimacy. HTTP requests receive a 301 redirect, and the page title returned is "Just a moment...", a generic placeholder that provides no insight into the malicious payload. VirusTotal scans have flagged the domain by four of ninety‑one security vendors, confirming that independent scanners have identified suspicious behavior. The site is already blocked by the PhishDestroy feed and appears on one external security blocklist, reinforcing its classification as a phishing vector. While the exact content and credential‑harvesting mechanisms have not been disclosed, the combination of a trusted TLS certificate, redirection behavior, and multiple vendor detections indicates a deliberate attempt to lure victims. Defenders should add the domain and its resolving IP to outbound and inbound blocklists, monitor DNS queries for the domain, and ensure that any user‑facing security controls (email filters, web gateways) are updated to flag traffic to this address. Continuous monitoring is advised to detect any changes in hosting or content that could amplify the threat.