kra46at[.]at

This domain is flagged as an active fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the threat type is a credential phishing scheme, with the page title 'Even geduld...' suggesting an attempt to mimic a loading or verification process while capturing input data. The risk level is classified as elevated due to confirmed malicious activity and multiple detection flags. Infrastructure analysis reveals the domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to the IP address 104.21.85.91, which is associated with Cloudflare services. The domain appears on one security blocklist and is flagged by 7 out of 95 security vendors on VirusTotal. Additional technical indicators include a Gridinsoft trust score of 0/100, a Google Trust Services SSL certificate, and the use of Cloudflare Browser Insights and HTTP/3 technologies. The domain is currently blocked by PhishDestroy, further corroborating its malicious nature. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (104.21.85.91) at the network perimeter. Organizations should deploy email and web filtering rules to prevent user access to kra46at.at and monitor for any attempts to interact with the domain. End-user training should emphasize recognizing fake login portals, particularly those using loading screens or verification delays as social engineering tactics. Security teams are advised to review logs for connections to the domain or IP and investigate any credential submissions originating from internal networks. If credentials were entered on this portal, they should be considered compromised and reset immediately, with multi-factor authentication enforced where possible.