kra24[.]at

Analysis of the domain kra24.at indicates elevated risk consistent with cryptocurrency-focused phishing activity. The domain, registered through Docky (Huang Chao Ming) via nic.at, resolves to the IP address 45.130.151.185, hosted on AS212913 (FOP Hornostay Mykhaylo Ivanovych) in Russia. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside nameservers ns1.gcorelabs.net and ns2.gcdn.services. SSL certification is provided by Let's Encrypt (R12), a common choice for both legitimate and malicious domains. Detection data shows the domain appears on three security blocklists, including PhishDestroy and MetaMask, which specifically flag cryptocurrency-related threats.

SEAL, another security vendor, has also blocked the domain. Gridinsoft assigns a trust score of 0/100, further supporting the classification of malicious intent. At the time of this report, the domain has been taken offline, though its prior activity remains under scrutiny. The page title, 'kra24.at,' does not provide explicit evidence of the targeted brand or service, leaving the exact nature of the phishing content uncertain.

However, the involvement of MetaMask in detection efforts suggests a likely focus on cryptocurrency users. Defenders are advised to treat this domain as malicious and prioritize blocking it at the network level, particularly in environments where cryptocurrency transactions occur. Monitoring for related infrastructure, such as the hosting IP or nameservers, may help identify additional threats. No further content analysis is available at this time.