molvixta[.]info

Analysis of molvixta.info indicates a high-risk phishing domain targeting Swiss motorway vignette users. The domain was registered on February 22, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, and remains active as of July 25, 2026. The page title, 'Molvixta - Ihr Schweizer Vignetten Ratgeber,' explicitly references Swiss vignettes, suggesting an attempt to deceive users seeking official road tax documentation. Infrastructure analysis reveals the domain resolves to 104.21.47.109, a Cloudflare IP (AS13335) located in the US, with nameservers bruce.ns.cloudflare.com and lovisa.ns.cloudflare.com.

The site uses a Google Trust Services SSL certificate (WE1) and returns an HTTP 200 status, indicating an operational frontend. Detection data is limited but notable: 3 of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist. PhishDestroy has blocked the domain, and Gridinsoft assigns a trust score of 0/100. The domain employs Cloudflare hosting and HTTP/3, which are common among both legitimate and malicious sites but often used by threat actors to obscure origin infrastructure.

No evidence links the domain to a known phishing kit or specific campaign beyond the vignette-themed page title. Defenders should treat molvixta.info as actively malicious based on the combination of phishing-related page content, recent registration, low trust scores, and vendor detections. Network-level blocking is recommended, particularly for organizations with users in German-speaking regions or those interacting with Swiss transportation services. Further investigation may clarify whether the site harvests payment details or distributes malware, but current evidence does not confirm either scenario.