initia[.]co

This domain, initia.co, is actively flagged as a high-risk brand impersonation threat targeting Discord users. Analysis indicates the site presents a page titled 'Initia,' with a 301 HTTP redirect status, suggesting it may funnel visitors to another malicious endpoint. The domain was registered on February 3, 2020, through GoDaddy.com, LLC, and currently resolves to 104.26.3.111, hosted on Cloudflare’s infrastructure (AS13335). Nameservers sureena.ns.cloudflare.com and weston.ns.cloudflare.com further confirm Cloudflare’s involvement in the domain’s hosting and security proxying. Infrastructure review reveals the use of Cloudflare Browser Insights and HTTP/3, alongside an SSL certificate issued by Google Trust Services (WE1). MX records point to Google’s mail servers, which may indicate an attempt to appear legitimate or facilitate credential harvesting via email. The domain appears on one security blocklist, and two out of 95 security vendors on VirusTotal have flagged it as malicious. While the exact content of the phishing page remains unconfirmed, the scam type is classified as social media impersonation, aligning with the target brand identified as Discord. Defenders should prioritize blocking this domain across web gateways, DNS filters, and email security controls. The use of Cloudflare’s infrastructure complicates direct takedown efforts, but monitoring for associated IP ranges (104.26.0.0/24) may help identify related malicious activity. Given the domain’s age and persistent activity, it is likely part of a broader campaign rather than an isolated incident. No evidence currently links this domain to additional payload delivery, but the 301 redirect warrants further investigation into downstream endpoints. Organizations should correlate logs for connections to 104.26.3.111 and review any user reports of Discord-themed phishing attempts originating from this domain.