lra47[.]at

Analysis of lra47.at shows a domain registered on 27 February 2026 that is presently offline. DNS resolution points to 172.67.128.226, an address owned by AS13335 Cloudflare, Inc. and located in the United States. The authoritative nameservers are galilea.ns.cloudflare.com and jihoon.ns.cloudflare.com, confirming Cloudflare as the hosting provider. The site presented an HTTP 403 status code, indicating that access was denied or that the resource is intentionally unavailable. The TLS certificate is issued by Google Trust Services under the WE1 identifier, demonstrating a valid, publicly trusted certificate chain.

The page title retrieved from the server is "lra47.at", which provides no additional context about the intended victim or lure. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, which classifies it as a generic phishing vector. VirusTotal records show that the domain was scanned by 93 antivirus and URL‑reputation vendors, none of which raised a detection at the time of analysis. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high level of suspicion. Automated fingerprinting identified Cloudflare Browser Insights, the Cloudflare CDN, and HTTP/3 support, all of which are common in both benign and malicious deployments.

Because the domain is currently offline, active content cannot be inspected, limiting the ability to confirm the phishing payload. The combination of a freshly created domain, Cloudflare front‑end, a legitimate TLS certificate, and immediate blocklist inclusion is a pattern frequently observed in fast‑flux phishing campaigns. Defenders should continue to block lra47.at at network perimeters, monitor for any future resolution changes, and consider adding the domain to internal watchlists. Ongoing observation is recommended until the investigation concludes and the threat is fully characterized.