via-bezahlung[.]de

Analysis of the domain via-bezahlung.de, created on 12 June 2026, shows that it is actively used in a phishing campaign targeting users of German‑language payment services. The domain resolves to the IPv4 address 188.114.97.3, which is the sole hosting indicator currently available. Reputation services have flagged the site: PhishDestroy lists it as blocked, and it appears on one public security blocklist. VirusTotal scans report that 15 of 91 security vendors classify the domain as malicious, reinforcing the suspicion of malicious intent.

The limited blocklist presence and the modest detection count suggest that the infrastructure is relatively new and may not yet be widely propagated across defensive feeds. Defenders should treat any traffic to via‑zahlung.de as hostile. Immediate actions include adding the domain and its resolved IP address to local deny lists, updating firewall and proxy rules to block outbound connections, and ensuring that intrusion detection signatures that reference the observed IP are deployed. Because the domain is only five days old, threat actors may still be experimenting with additional hosting or DNS resolution techniques; continuous monitoring of DNS queries for the name and its IP is recommended.

Analysts should also query intelligence platforms for any emerging associations with other malicious domains or campaigns, as future observations may reveal a broader command‑and‑control infrastructure. No SSL certificate details, registrar information, or page title have been disclosed by the current intelligence feed, limiting the ability to assess TLS hygiene or content spoofing. The absence of these data points does not diminish the observed malicious classification. Until further evidence is gathered, the precautionary stance is to quarantine any emails or web requests that reference via‑zahlung.de and to alert end‑users about the observed phishing activity.