jra9[.]at

Analysis of jra9.at indicates that the domain was registered on 27 February 2026 through the Austrian registrar Gransy s.r.o. The authoritative nameservers are aarav.ns.cloudflare.com and robin.ns.cloudflare.com, and the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The web server reports an HTTP 403 response and advertises Cloudflare Browser Insights, Cloudflare and HTTP/3 as underlying technologies; no TLS certificate was observed, suggesting that the site is served over plain HTTP. The page title returned by the server is the literal string "jra9.at". The domain has been flagged by PhishDestroy and appears on a single external blocklist, indicating that at least one security‑focused organization has taken it offline.

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low confidence in its legitimacy. VirusTotal records show that the domain was scanned by 93 antivirus or URL‑reputation engines, none of which raised a detection at the time of analysis; this absence of detections does not constitute an assurance of safety. The absence of an SSL certificate is atypical for legitimate services that handle user credentials, and the 403 response may be a default denial from Cloudflare when malicious content is blocked. The combined indicators—recent registration, use of Cloudflare front‑end services, lack of TLS, a generic page title, a 403 status, a zero trust score, and inclusion on a phishing‑specific blocklist—are consistent with a generic phishing infrastructure that is currently inactive.

However, because the site is offline, the full payload, target brand, or credential‑capture mechanisms cannot be confirmed. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the address 188.114.97.3, and update any allow‑list policies that might inadvertently permit traffic to this host.