ra47[.]at

The domain ra47.at is an active generic phishing site posing an elevated risk. It does not impersonate a specific brand or deploy a known drainer kit but is designed to harvest credentials or other sensitive information through deceptive means. As of the latest verification, ra47.at remains operational and has not been widely flagged by major security services, though it is recognized as a phishing threat by some vendors.

Technical indicators for ra47.at show limited detection, with 1 of 95 VirusTotal security vendors flagging it as malicious. The domain was created on 2026-02-21 and resolves to the IP address 172.67.157.142, hosted on Cloudflare's infrastructure (AS13335) in the US. It appears on 1 security blocklist (PhishDestroy) and uses an SSL certificate issued by Google Trust Services / WE1. The observed page title is 'Captcha', and the site returns an HTTP 403 status. Technologies detected include Ubuntu, Nginx, and HSTS, while the nameservers are brit.ns.cloudflare.com and grant.ns.cloudflare.com.

Users who may have interacted with ra47.at should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized activity or fraud. If financial or cryptocurrency details were exposed, consider revoking token approvals and transferring funds to a new wallet. Report the domain to relevant authorities or platforms, such as Google Safe Browsing, PhishTank, or local cybercrime units, to aid in takedown efforts and prevent further victimization.