kra3-at[.]sbs

The domain kra3-at.sbs was registered on March 28, 2026 via Global Domain Group LLC and is currently active. It presents a page titled krab5.cc and returns an HTTP 302 redirect, indicating a possible attempt to hide the final landing location. The risk level is classified as high, and the campaign is identified as a generic phishing operation.

Infrastructure analysis shows the domain resolves to IP address 104.21.62.98, which is owned by Cloudflare, Inc. and geolocated to California, United States. The authoritative nameservers are keenan.ns.cloudflare.com and sunny.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The site presents a Let’s Encrypt certificate (E7), providing TLS encryption but offering no authentication of the underlying content.

Threat intelligence sources corroborate the malicious nature of the domain. AlienVault OTX lists the domain in one threat‑intel pulse, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal reports that 1 of 95 security vendors flagged the domain, reinforcing the suspicion of malicious activity despite the low overall detection count.

Defenders should block traffic to kra3-at.sbs at the network perimeter and include the associated IP address 104.21.62.98 in deny lists. Monitoring for the page title krab5.cc and the 302 redirect pattern can aid in early detection of similar campaigns. Continuous reassessment of reputation feeds is advised, as additional detections may emerge as the campaign evolves.