omni[.]variationsl[.]io

Analysis of omni.variationsl.io shows it is an active generic phishing site flagged as high‑risk. The domain resolves to IP 104.21.28.189, which is hosted by Cloudflare, Inc. in Canada, and serves a TLS certificate issued by Google Trust Services under the WE1 authority. An HTTP 301 redirect is observed, and the page title returned is "Just a moment...". The site is currently blocked by the PhishDestroy service and appears on a single external blocklist. VirusTotal scans indicate that four of ninety‑one security vendors have classified the domain as malicious. The infrastructure evidence suggests the operators are leveraging Cloudflare’s CDN to obscure origin, and the generic page title provides no additional context about the intended victim brand or credential capture method. Uncertainty remains regarding the exact phishing kit or target audience, as no brand name or specific credential‑collection page has been identified. Defenders should prioritize adding omni.variationsl.io and its resolved IP address to network‑level blocklists, enforce DNS sinkholing, and monitor outbound traffic for connections to Cloudflare‑hosted IPs matching this pattern. Continuous re‑evaluation is advised, given the active status and potential for rapid re‑hosting.