myviaadmin-ch[.]com

Analysis indicates that the domain myviaadmin-ch.com was registered on February 21, 2026 through Unstoppable Domains Inc., a service often used for decentralized domain naming. The domain resolves to the IPv4 address 91.238.163.174, which is announced by AS52148 belonging to Enix Ltd in the United Kingdom. A TLS certificate issued by Let’s Encrypt (R12) is presented, confirming that the site serves content over HTTPS. An HTTP request returns a 302 redirect, a pattern frequently observed in phishing infrastructure to forward victims to a credential‑harvesting page.

The page title observed by scanners reads "Via Portal: Your digital key for e‑vignette and PSVA", suggesting an attempt to lure users of European vehicle‑related services. The domain appears on one public phishing blocklist and has been actively blocked by the PhishDestroy service. VirusTotal reports that 14 of 91 security vendors have flagged the domain, reinforcing the malicious assessment. Nameserver records point to Google Cloud DNS (ns‑cloud‑b1 through b3), a common hosting choice for disposable phishing sites.

While the exact payload and credential‑capture mechanisms have not been publicly disclosed, the combination of recent registration, redirection behavior, targeted page title, and multi‑vendor detection provides sufficient confidence to classify the infrastructure as a high‑risk phishing operation. Defenders should add the domain and its resolving IP address to outbound and inbound blocklists, monitor DNS queries for the associated Google nameservers, and consider issuing sinkhole redirects for the 302 response. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel feeds are recommended to capture any evolution of the campaign.