finarona[.]info

This domain is flagged for credential theft operations impersonating Swiss toll vignette services under the pretext of "Vignetten-Info 2026." The site specifically targets users seeking information about the Gotthard tunnel toll requirements, presenting a fraudulent interface designed to harvest login credentials, payment details, or personal identification data associated with Swiss motorway access permits. The localized German-language content and timing suggest an attempt to exploit upcoming regulatory changes or seasonal travel patterns. Analysis indicates the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with low-reputation domains. Infrastructure analysis reveals the site resolves to IP address 172.67.132.229 and employs Cloudflare services, including HTTP/3, to obscure hosting origins. Despite zero detections in VirusTotal's 95-engine scan, the domain appears on one security blocklist, indicating prior identification by automated or community-driven threat intelligence platforms. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to visitors. Users who accessed finarona.info should immediately revoke any credentials entered on the site, particularly those associated with financial services or government-issued identification. Monitor accounts linked to the provided information for unauthorized transactions or access attempts. Given the domain's recent creation date and offline status, consider this incident part of a broader campaign; verify the legitimacy of any communication claiming to be from Swiss toll authorities through official channels. Network administrators should block the domain and associated IP address 172.67.132.229 at perimeter defenses to prevent further exposure.