viaonmove[.]digital

This domain, viaonmove.digital, is flagged as a credential phishing site designed to harvest user login credentials through deceptive web pages. The site mimics legitimate login portals, tricking visitors into entering sensitive information such as usernames, passwords, or financial details. Such data is then exfiltrated to threat actors for unauthorized access, identity theft, or financial fraud. The risk is elevated due to the domain’s recent creation and active use of evasion techniques, including content delivery network masking. Analysis indicates the domain was registered on February 21, 2026, through Dynadot LLC, a registrar commonly used in phishing operations. It resolves to the IP address 172.67.196.127, which is associated with Cloudflare infrastructure, a tactic frequently employed to obscure hosting origins and evade detection. On VirusTotal, 7 out of 95 security vendors flagged this domain as malicious, confirming its association with phishing activity. The site was served over HTTP/3 and used a Google Trust Services SSL certificate, further complicating detection by blending in with legitimate traffic. Users who visited viaonmove.digital or entered credentials on the site should take immediate action. First, reset passwords for any accounts accessed or entered on the site, prioritizing email, banking, and social media platforms. Enable multi-factor authentication wherever possible to mitigate unauthorized access. Monitor financial statements and credit reports for suspicious activity, as stolen credentials may be used for fraudulent transactions. If corporate or organizational credentials were exposed, report the incident to internal security teams for containment and forensic review. Additionally, scan local devices for malware, as phishing sites may deliver secondary payloads via drive-by downloads or malicious scripts.