infiniteaura[.]io

Analysis of infiniteaura.io indicates that the domain was registered on 21 February 2026 and is currently offline. The site resolved to the Cloudflare‑owned address 172.67.192.147, which is associated with AS13335 in the United States. The TLS certificate presented for the host is identified as “WE1”, a generic certificate that does not provide brand‑specific validation. The page title returned by the HTTP response reads “aura – Cultivate a magnetic presence”, which bears no direct reference to the targeted brand.

However, threat intelligence tags the domain as a brand‑impersonation campaign aimed at Telegram, suggesting that the underlying content may have attempted to lure Telegram users. The domain appears on two independent security blocklists, PhishDestroy and ScamSniffer, confirming that at least two reputable monitoring services have flagged it as malicious. VirusTotal scanning recorded a single positive detection out of 93 scanned engines, indicating that at least one vendor identified the site as suspicious. The Gridinsoft trust score is 0 / 100, reinforcing the conclusion that the host is considered untrustworthy by that assessment tool.

Given the limited public artifacts, the precise phishing workflow (e.g., login clone, credential harvesting page) has not been disclosed, and no sandbox or URL‑preview captures are available. Defenders should therefore treat any traffic to or from infiniteaura.io as high‑risk, block the domain at the network perimeter, and monitor for related indicators such as the Cloudflare IP address 172.67.192.147 and the “WE1” certificate fingerprint. Continuous re‑evaluation is advised in case the site is re‑activated or additional detections emerge.