omni[.]variationzl[.]io

The domain omni.variationzl.io is currently classified as high risk for phishing based on several corroborated technical indicators. As of July 19, 2026, the domain remains active and is listed on at least one established security blocklist, specifically being blocked by PhishDestroy. Analysis shows it is resolving to the IP address 172.67.159.214, which is associated with Cloudflare, Inc. infrastructure in Canada. The HTTP response is a 301 redirect, and the page title observed is 'Just a moment...', which is commonly seen on sites employing interstitials or traffic filtering. The domain presents with a valid SSL certificate issued by Google Trust Services (WE1), which is not, in itself, an indicator of legitimacy or safety. VirusTotal scanning results reveal that 4 out of 91 security vendors have flagged this domain as malicious or suspicious. While the specific brand target or phishing content is not identified in the available data, the presence on multiple security blocklists and positive detections among industry vendors provide credible evidence of active abuse. Defenders should block access to omni.variationzl.io within their networks and monitor for any related indicators of compromise, given its continued operational status and corroborated malicious activity. Further analysis is needed to determine the exact content and techniques used, but the accumulated evidence supports immediate caution and mitigation.