vigta[.]xyz

vigta.xyz was registered on 2026-06-29 through CSL Computer Service Langenbach GmbH d/b/a joker.com and is served by the Cloudflare nameservers dalary.ns.cloudflare.com and newt.ns.cloudflare.com. DNS resolution points to the IPv4 address 193.36.85.15, which remains reachable as of the report date. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, indicating that at least one anti‑phishing service has identified it as malicious. VirusTotal reports that one out of ninety‑five scanning engines flagged the domain, providing limited but corroborating evidence of suspicious activity. No additional public reputation services, Safe Browsing checks, or Open Threat Exchange entries were supplied, and the site’s page title and content have not been publicly analysed, leaving the exact phishing lure undefined. The short lifespan of the domain—created less than a month before the current assessment—combined with the registrar’s association to a known reseller suggests a rapid‑deployment model often used for credential‑harvesting campaigns. Defenders should consider adding 193.36.85.15 and vigta.xyz to network‑level deny lists, monitor DNS queries for the Cloudflare name servers, and enforce sink‑hole redirects for any attempted connections. Continuous re‑inspection of the URL through sandbox or browser‑based analysis is recommended to capture any payloads or credential‑stealing forms that may appear as the campaign evolves. Until further forensic evidence is gathered, the domain should be treated as a high‑risk phishing vector.