omni[.]variarional[.]io

Analysis of omni.variarional.io indicates that the domain is currently active and serving a generic phishing page identified by the title “Just a moment…”. The site resolves to the Cloudflare‑owned address 104.21.50.213, which is associated with the CA data center location of Cloudflare, Inc. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming that HTTPS connections terminate at a legitimate certificate authority. An HTTP 301 response is observed, suggesting a redirection before the final content is delivered. VirusTotal has recorded detections from four out of ninety‑one scanning engines, and the domain is listed on a single external blocklist that is actively enforced by the PhishDestroy service. These indicators collectively demonstrate that the infrastructure is being leveraged for a phishing operation, although the specific target brand or credential‑harvesting mechanism has not been disclosed in the available evidence. The presence of a generic “Just a moment…” title may indicate a waiting page used to evade automated analysis. Defenders should block the domain at network perimeter, monitor DNS queries for the IP address 104.21.50.213, enforce TLS inspection to capture the redirect chain, and incorporate the domain into threat‑intel feeds. Ongoing observation is recommended to determine whether additional payloads or credential‑collection pages are deployed behind the redirect.