omni[.]variatkonal[.]io

On July 19, 2026 the domain omni.variatkonal.io was observed delivering a generic phishing payload. The site returns an HTTP 301 redirect and presents the page title “Just a moment…”. The TLS certificate is issued by Google Trust Services under the WE1 label, indicating use of a publicly trusted certificate. DNS resolution points to 188.114.97.3, an address owned by CloudFlare, Inc. located in Canada. VirusTotal analysis shows four of ninety‑one security vendors have flagged the domain, and it is listed on one external blocklist. The domain is currently marked as active and has been added to the PhishDestroy blocklist. The available data does not reveal the specific credential‑stealing page or target brand, and no further samples of the hosted content have been captured. Consequently, defenders should treat the domain as high‑risk, block resolution to 188.114.97.3 at the network perimeter, monitor for outbound connections to the IP, and add the domain to internal URL filtering and phishing‑prevention lists. Continued telemetry collection is recommended to confirm whether additional malicious infrastructure or payload variants appear.