omni[.]variationql[.]io

omni.variationql.io is currently flagged as a high‑risk generic phishing site. Infrastructure analysis shows the domain resolves to 188.114.96.3, an address owned by CloudFlare, Inc. and geolocated to Canada. The host presents a valid TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating that encryption is in place despite malicious intent. An HTTP 301 response redirects clients to the same host, and the page title returned is “Just a moment…”, a common placeholder often used to stall analysis tools. The domain is listed on one public blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans have recorded detections by four of ninety‑one AV engines, reinforcing the suspicion of malicious activity. The public intelligence does not reveal the exact payload or target brand, and no further content has been captured. Given the observed indicators, defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated CloudFlare IP, and include the host in email gateway filters. Continued observation is recommended to capture any evolving payloads or credential‑harvesting pages that may be deployed behind the placeholder title.