kra46l[.]at

Analysis as of July 24, 2026 indicates that kra46l.at is presently taken offline, returning HTTP 403 responses. The domain resolves to IP 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. SSL termination is provided by Google Trust Services under the WE1 certificate, confirming the use of a legitimate TLS issuer but not authenticating the underlying site. The only page element captured is the title “Nur einen Moment…”, which offers no indication of the intended victim brand or campaign context.

Infrastructure fingerprints show Cloudflare Browser Insights, Cloudflare routing, and HTTP/3 support, consistent with a typical abuse‑hosting setup. Reputation data are unfavorable: PhishDestroy has listed the domain, AlienVault OTX includes it in one threat pulse, and VirusTotal reports four detections out of ninety‑five scanners. Gridinsoft assigns a trust score of zero out of one hundred, and the domain appears on a single public blocklist. Nameservers aldo.ns.cloudflare.com and asa.ns.cloudflare.com are standard Cloudflare entries, providing no further attribution.

The combination of a generic phishing classification, low trust scores, multiple vendor detections, and the presence on blocklists suggests a high likelihood of malicious intent despite the current offline state. Defenders should continue to block the domain at network perimeter, add it to URL filtering and threat‑intelligence feeds, and monitor the associated IP range for any re‑activation. Because the page content has not been captured beyond the title, the exact phishing lure remains unknown, and further investigation would be required if the site returns to service.