varuational[.]io

This domain, varuational.io, was registered on 26 May 2026 through GNAME.COM PTE. LTD. and is currently hosted on the Cloudflare network, resolving to the IPv4 address 172.67.220.39. The authoritative nameservers are henrik.ns.cloudflare.com and noor.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. VirusTotal analysis shows that 4 of 91 security vendors have flagged the domain as malicious, confirming that at least a subset of scanners recognize it as a threat.

Independent blocklist providers have also taken action: PhishDestroy, MetaMask and SEAL list the domain, and it appears on three additional security blocklists, reinforcing the consensus that the site is being used for phishing. Publicly available intelligence does not yet reveal the site’s SSL certificate details, HTTP response code, page title, or any associated evidence URLs, so the exact content served by the domain remains uncertain. Likewise, Safe Browsing status, Open Threat Exchange (OTX) references, and trust‑score metrics have not been published. The lack of these data points limits the ability to describe the specific phishing campaign or the targeted brand. Defenders should treat varuational.io as a high‑risk indicator.

Network perimeter and endpoint controls ought to block DNS resolution to the domain and deny outbound connections to its IP address. Email gateways should add the domain to phishing‑domain deny lists, and security information and event management (SIEM) rules should be updated to alert on any observed traffic to 172.67.220.39. Continuous monitoring of Cloudflare‑related IP ranges for additional malicious activity is recommended, as the infrastructure may be reused for other campaigns. Organizations that have observed related phishing attempts should share indicators of compromise (IOCs) with threat‑sharing communities to accelerate collective mitigation.