kkra5[.]at

Analysis indicates that the domain kkra5.at was actively serving malicious content and has since been taken offline, returning HTTP 403 responses. The domain resolves to IP 172.67.204.73, a Cloudflare‑owned address located in Canada, and presents a TLS certificate issued by Google Trust Services under the WE1 root, a common certificate for legitimate services. Threat intelligence sources have flagged the domain: it appears on one security blocklist, has been included in two AlienVault OTX pulses, and was detected by three of ninety‑one VirusTotal scanners. PhishDestroy also blocks the domain. The limited detection count suggests the site may have been short‑lived or low‑profile, but the presence of a valid certificate does not mitigate the phishing risk. Because the site is currently offline, immediate impact is reduced, yet the infrastructure—namely the Cloudflare front‑end—could be reused for future campaigns. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the hostname, and consider adding the IP address 172.67.204.73 to deny lists. Ongoing vigilance is advised in case the domain is re‑registered or the underlying IP is repurposed for new malicious activity.