evia-servic[.]digital

The domain evia-servic.digital is currently active and hosted behind Cloudflare. It resolves to 172.67.222.240, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain was registered on February 21, 2026 through Dynadot LLC and uses the nameservers bart.ns.cloudflare.com and colette.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services / WE1, indicating a valid HTTPS connection. HTTP requests return a 200 status code and the page title observed is 'Ihr Leitfaden für die Schweizer Vignette | evia-servic.digital', suggesting the site is presenting a guide related to the Swiss vignette. The site is detected by three of ninety‑three VirusTotal scanners and appears on one external blocklist; it is also listed by PhishDestroy.

Technologies identified include Cloudflare edge services and HTTP/3 support. Analysis indicates that the infrastructure is typical of a fast‑flux‑style phishing host, leveraging Cloudflare’s CDN to hide the true origin. The presence of a legitimate‑looking SSL certificate does not mitigate the risk, as Cloudflare can provide certificates for any domain. The page title and language point to a targeted campaign aimed at users seeking Swiss motorway vignette information, but the content has not been examined directly. The limited detection footprint (three VT detections) suggests the domain is relatively new, consistent with its February creation date.

Defenders should block the domain at network perimeter and add it to URL filtering lists. Monitoring of DNS queries for the two Cloudflare nameservers can provide early warning of additional domains using the same infrastructure. Because the site is already listed by PhishDestroy, integrating that feed into security tools will improve coverage. Continuous re‑scanning on VirusTotal and other sandbox services is recommended to capture any malicious payloads that may be served later.