via-evignetu[.]cyou

Analysis of the domain via-evignetu.cyou, observed on July 24 2026, indicates that it is being used for brand impersonation targeting the Ankr service. The site was registered on 22 September 2025 through Web Commerce Communications Limited and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative name servers are Cloudflare (cheryl.ns.cloudflare.com and graham.ns.cloudflare.com). No TLS certificate was detected for the host, meaning the connection is served without encryption.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, and VirusTotal reports that 2 of 95 scanned security vendors flagged it as malicious. The public page title returned by the server reads “Via Portal: Ihr digitaler Schlüssel für E‑Vignette und PSVA,” which aligns with the declared scam type of brand impersonation. The domain is currently taken offline, but the infrastructure details remain valid for correlation.

Uncertainty remains regarding the specific phishing kit or payload, as no further content analysis is available. Defenders should add the IPv4 address 188.114.97.3 to outbound filtering rules, monitor DNS queries for the two Cloudflare name servers, and ensure that any traffic to via-evignetu.cyou is blocked at the perimeter. Continuous re‑scanning on VirusTotal and inclusion in internal blocklists are recommended to capture any future re‑activation.