bazg-via2026[.]info

This domain, bazg-via2026.info, is actively impersonating an official Swiss government digital portal for E-Vignette and PSVA services, as indicated by its page title 'Via Portal: Ihr digitaler Schlüssel für E-Vignette und PSVA.' Analysis confirms the domain is flagged by 14 out of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and BLP-Malware. It remains unresolved in 23 threat intelligence pulses, suggesting persistent malicious activity targeting users seeking government-issued digital vehicle permits. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3, hosted behind Cloudflare, which is consistent with tactics used to obscure origin and evade detection. The SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy, while the use of HTTP/3 indicates modern web protocols that may bypass older security controls. The registration details point to Cloudflare as the registrar, further complicating attribution. The exact content and functionality of the site remain unconfirmed, as no forensic analysis of the page structure or backend has been conducted. However, the combination of brand impersonation, active blocklist presence, and high vendor detection rate indicates a high-risk operation likely designed to harvest credentials or payment details from unsuspecting users. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network perimeter levels. No evidence currently links this domain to a specific threat actor or campaign beyond the impersonation of Swiss government services. The domain's continued activity despite blocklist inclusion suggests either low user reporting or deliberate evasion techniques. Security teams should monitor for related domains using similar naming conventions or infrastructure patterns, particularly those leveraging Cloudflare and Google Trust Services certificates.