raiffeisen-gabe[.]vip

The domain raiffeisen-gabe.vip is identified as a generic_phishing site, likely impersonating Raiffeisen, a well-known financial institution. No specific drainer kit has been identified, but the domain is designed to deceive users into providing sensitive information such as login credentials and personal data.

Analysis indicates that the domain has a VirusTotal score of 21/95, suggesting a moderate level of detection by security vendors. The domain is registered through NameSilo, LLC and resolves to the IP address 151.101.131.10, which is associated with Cloudflare, Inc. (AS13335) and located in the United States. The domain was created on April 29, 2026, and appears on 1 security blocklist, indicating some level of recognition within the security community. The site's page title, 'Karten- und Bezahllösungen,' further suggests an attempt to mimic legitimate Raiffeisen services related to card and payment solutions.

The domain is currently active and poses an elevated risk to users who may be deceived by its resemblance to a legitimate Raiffeisen site. Recommended response actions include blocking the domain at the network level, educating users about the signs of phishing, and implementing multi-factor authentication for sensitive accounts. Despite the domain being blocked by PhishDestroy, there remains a significant risk as 21 security vendors have flagged it, and it continues to resolve to a Cloudflare IP, potentially masking the true origin of the threat.