omni[.]variatioanl[.]io

This investigation examines omni.variatioanl.io, which is currently classified as a high‑risk generic phishing site. The domain resolves to the IP address 188.114.97.3, which is hosted by Cloudflare, Inc. and geolocated to Canada. HTTP requests receive a 301 redirect and the page title returned is “Just a moment…”. The TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid certificate chain. The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis shows four of ninety‑one scanners flag the domain, confirming malicious activity. The site remains active as of the report date, July 19 2026. Infrastructure analysis suggests the attacker is leveraging reputable CDN services to obscure origin and to benefit from trusted SSL certificates, a common tactic for phishing campaigns. The limited detection footprint—only a few scanners flagging the domain—implies that the payload or landing page may be transient or that the site is in early deployment. Defenders should block DNS resolution for omni.variatioanl.io, enforce URL filtering, and monitor outbound connections to the associated IP. Additional scrutiny of traffic patterns to Cloudflare‑served IPs is advised, as is periodic re‑scanning to detect any changes in the site’s behavior.