krab19[.]at

The domain krab19.at is identified as a generic phishing site designed to replicate login portals for credential harvesting. Analysis indicates the domain is currently offline, though prior activity suggests it was actively targeting users through deceptive authentication interfaces. No specific brand impersonation has been confirmed, but the infrastructure aligns with common phishing tactics used to extract sensitive information. Infrastructure analysis reveals the domain was registered on March 31, 2026, through TLD Registry (.at). It is flagged by 2 of 95 security vendors on VirusTotal, with detection engines classifying it as malicious. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt, a common choice among threat actors due to its accessibility and free provisioning. No associated IP addresses or hosting providers have been publicly documented in this campaign, limiting further network-based attribution. At present, krab19.at has been taken offline, reducing immediate risk to end users. However, the domain’s recent registration and prior malicious classification warrant continued monitoring. Organizations and individuals are advised to block the domain at the network level and review logs for any prior connections. Users who may have interacted with the site should reset credentials for any accounts entered on the portal and enable multi-factor authentication where available. Security teams should treat this domain as part of a broader phishing campaign and correlate indicators with other known malicious infrastructure.