velixta[.]info

This domain is flagged as an elevated-risk credential theft operation targeting users seeking Swiss road tax vignettes. Analysis indicates the site, titled 'Velixta - Schweizer Vignetten Informationsdienst,' masquerades as an official information service to harvest login credentials or payment details from unsuspecting motorists. The infrastructure exhibits multiple indicators of malicious intent, aligning with known phishing patterns for government or transport-related services. Infrastructure analysis reveals the domain velixta.info was registered on February 22, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 104.21.47.55 and is associated with an SSL certificate issued by Google Trust Services. Security vendors on VirusTotal flagged the domain at a rate of 2/95, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and employs Cloudflare with HTTP/3 and Cloudflare Browser Insights, common among phishing sites for evasion and performance masking. Its current offline status suggests takedown action, though historical DNS records may still pose residual risks. Mitigation against credential theft via transport service impersonation requires user verification of domain authenticity. Users should cross-reference official government or service provider URLs, avoiding third-party links in emails or search results. Organizations should implement DNS-based blocking for the identified IP (104.21.47.55) and monitor for similar newly registered domains under the same registrar. Multi-factor authentication (MFA) for accounts accessing transport or payment services reduces the impact of stolen credentials. Security teams should inspect logs for connections to the resolved IP and domain, particularly from networks with prior access to Swiss vignette services.