roadguideswiss[.]com

This domain, roadguideswiss.com, is flagged as a credential harvesting phishing site targeting users of Swiss travel and tourism services. Analysis indicates the domain is currently offline, displaying an SSL handshake failure (HTTP 525) rather than an active phishing page. No legitimate brand association has been confirmed, though the domain name suggests an attempt to impersonate official Swiss travel guidance platforms to deceive users into submitting sensitive login or payment details. Infrastructure analysis reveals the domain was registered on February 22, 2026, through Hello Internet Corp, a registrar frequently observed in phishing campaigns. It resolves to the IP address 188.114.97.3, which is part of Cloudflare’s network, a common tactic to obscure hosting origins and leverage SSL encryption. Despite its recent creation, the domain has already been flagged on one security blocklist, though it remains undetected by all 95 vendors in VirusTotal’s latest scan. The SSL certificate is issued by Let’s Encrypt, a free and widely abused certificate authority in phishing operations. Additional trust metrics, such as a Gridinsoft score of 0/100, further corroborate its malicious classification. As of the latest assessment, roadguideswiss.com is offline, though its infrastructure remains intact and could be reactivated. Security teams are advised to monitor the domain for renewed activity and include it in real-time blocklists. Network administrators should inspect logs for connections to 188.114.97.3 and alert users who may have interacted with the domain prior to its takedown. Given the use of Cloudflare, organizations should also review proxy evasion techniques in their detection rules to prevent similar threats from bypassing security controls.