sylvarixra[.]digital

Analysis on July 25, 2026 indicates that the domain sylvarixra.digital is actively used in a generic phishing operation. The site returned HTTP 200 and presents the page title “Sylvarixra — Straßenmaut Österreich: Ratgeber für Autofahrer”, suggesting an attempt to lure Austrian drivers. The domain was registered on 22 February 2026 through Dynadot LLC and is hosted behind Cloudflare (AS13335). DNS resolution points to 188.114.96.3, and the service is delivering traffic over HTTP/3 with Cloudflare Browser Insights enabled. SSL is provided by Let’s Encrypt with an E8 certificate, confirming a valid TLS handshake.

Reputation services show mixed detection: three of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single security blocklist. PhishDestroy has actively blocked the host, and Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. The nameservers are wells.ns.cloudflare.com and deborah.ns.cloudflare.com, both typical of Cloudflare‑managed zones. The evidence confirms the domain’s malicious use, but the exact phishing kit, credential capture method, and any associated command‑and‑control infrastructure remain undisclosed.

No further threat intelligence such as OTX indicators or additional blocklist entries were observed. Defenders should add sylvarixra.digital to URL filtering and web‑proxy rules, enforce TLS inspection to capture the underlying content, and monitor DNS queries for the associated Cloudflare nameservers. Network traffic to the IP 188.114.96.3 should be flagged, and endpoints should be instructed to block any credential submission to pages matching the observed title. Ongoing monitoring of VirusTotal and other reputation feeds is advised to capture any new detections.