ral7t[.]com

The domain ral7t.com is presently classified as a generic phishing site with a high risk rating. It was created on 1 August 2025 and remains active as of 12 July 2026. The page title returned by the server is "MWBE-AOAY", and the site is served over HTTPS using a certificate issued by Google Trust Services under the WE1 branch. VirusTotal records indicate that 17 of 95 security vendors have flagged the domain, and Google Safe Browsing lists it under the SOCIAL_ENGINEERING category. Network analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated to the United States. The authoritative nameservers are holly.ns.cloudflare.com and watson.ns.cloudflare.com, confirming Cloudflare as the DNS and edge provider. The server issues an HTTP 301 redirect and advertises support for HTTP/3, HSTS, and the Vue.js JavaScript framework, indicating a modern web stack. Reputation data reveals the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. While the page title is known, the exact content of the landing page has not been captured, so the specific phishing lure or credential collection method cannot be described at this time. Defenders should add ral7t.com to URL filtering and DNS sinkhole rules to prevent client resolution. Monitoring of outbound traffic to the IP 188.114.96.3 is advised, as well as inspection of TLS handshake metadata for the Google Trust Services certificate. Given the high‑risk classification and the presence of multiple vendor detections, organizations are encouraged to treat any interaction with this domain as malicious and to educate users about the associated social engineering threat.