vaironex[.]io

The domain vaironex.io was registered on 18 December 2025 through Immaterialism Limited and resolves to the Cloudflare‑owned address 172.67.148.237 (AS13335, United States). The site is presently offline and returns HTTP 500, indicating a server‑side failure. Its TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid HTTPS certificate. Nameserver records point to kristina.ns.cloudflare.com and nicolas.ns.cloudflare.com, further confirming Cloudflare as the hosting provider. MX configuration includes a single record with priority 0 pointing to _dc-mx.1c8ceb0c2f77.vaironex.io, a sub‑domain that has not been observed in other legitimate services.

The page title delivered by the server reads “Vaironex Cloud | Decentralized Live Video APP,” which does not reference the targeted brand. However, the intelligence profile classifies the campaign as a Discord brand‑impersonation social‑media phishing operation. The domain appears on one security blocklist, PhishDestroy, and has been cited in a single AlienVault OTX pulse. VirusTotal analysis shows eight of ninety‑three scanners flagging the domain as malicious, contributing to the overall risk assessment of elevated. Reputation metrics are extremely low; Gridinsoft assigns a trust score of 1 out of 100, indicating a high likelihood of abuse.

The limited detection footprint—only one blocklist entry and modest VirusTotal detections—suggests the infrastructure may be newly deployed or deliberately low‑profile. Because the site is currently offline, automated content inspection could not be performed, leaving the exact phishing payload unverified. Defenders should proactively block or sinkhole the IP address 172.67.148.237 and add vaironex.io to domain‑based denylists, especially in environments where Discord credentials are used. Continuous monitoring of Cloudflare‑hosted subdomains and MX records is recommended to detect potential re‑use.