via-dashbard[.]digital

Analysis of the domain via-dashbard.digital, first observed on February 22 2026, shows a high‑risk brand‑impersonation campaign targeting the cryptocurrency platform Sei. The domain is registered through Dynadot LLC and is served from Cloudflare's network (ASN 13335) with the IP address 104.21.3.163 located in the United States. Both authoritative name servers, wesley.ns.cloudflare.com and luciane.ns.cloudflare.com, resolve to Cloudflare's edge infrastructure, and the site presents a valid HTTPS certificate issued by Let’s Encrypt (certificate identifier E8). An HTTP request returns status code 200, and the page title returned by the server is “Startseite | VIA Dashbard GmbH”, which does not reference the target brand, indicating that the front‑end content has not been publicly disclosed.

Security telemetry shows the domain is listed on a single blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal scans report that 2 of 95 AV engines have flagged the host, confirming malicious intent despite the low overall detection count. Detected technologies include Cloudflare’s reverse‑proxy services and HTTP/3 support, both of which are commonly leveraged to hide malicious payloads behind legitimate CDN traffic. The available evidence confirms a brand‑impersonation scheme aimed at deceiving Sei users, yet the exact phishing vector (e.g., login page, credential‑harvesting form) remains unknown because no page content or URL paths have been captured.

Consequently, defenders should continue to block the domain at network perimeters, update URL filtering lists, and monitor for any new subdomains or DNS changes associated with the same Cloudflare name servers. Endpoint security solutions should be configured to flag any outbound connections to 104.21.3.163 and to alert on TLS certificates issued by Let’s Encrypt for this domain.