av-eprotocol[.]la

Analysis of the domain av-eprotocol.la indicates targeted brand impersonation activity directed at Sei, a blockchain platform. The domain was registered on August 8, 2025, through NiceNIC International Group Co., Limited, and currently resolves to IP address 95.129.234.38, hosted by DDOS-GUARD LTD (AS57724) in Russia. Cloudflare nameservers sasha.ns.cloudflare.com and seth.ns.cloudflare.com are configured, and the SSL certificate is issued by Let's Encrypt with serial number E8. As of July 23, 2026, the domain returns an HTTP 404 status with a page title of '404 Error,' suggesting either takedown or temporary concealment of malicious content.

Detection data shows the domain appears on one security blocklist and is flagged by PhishDestroy. AlienVault OTX records it in a single threat intelligence pulse, while Scamadviser assigns a trust score of 1 out of 100. Twelve of 95 security vendors on VirusTotal detect the domain as malicious. The domain is currently offline, though prior infrastructure and detection patterns suggest it was actively used in phishing operations.

Defenders should treat this domain as high-risk infrastructure associated with Sei brand abuse. Network-level blocking is recommended, and monitoring for re-emergence or related domains using the same IP, registrar, or nameserver patterns is advised. The exact phishing kit or payload remains unconfirmed due to the 404 status, but the available evidence supports classification as a brand impersonation scam targeting Sei users.