rab3[.]at

PhishDestroy has identified rab3.at as a generic phishing domain currently active and posing an elevated risk to users. The site presents a fraudulent CAPTCHA page, a common technique used to trick visitors into believing they are verifying their humanity while actually harvesting sensitive information. This specific threat type is credential theft, as the fake CAPTCHA is designed to capture login details or other personal data. The domain does not impersonate a specific brand but relies on the widespread familiarity with CAPTCHA challenges to lower user suspicion.

Technical analysis reveals that rab3.at was created on February 21, 2026, and registered through Gransy s.r.o., a Czech registrar. The domain resolves to IP address 188.114.97.3 and is secured with a Let's Encrypt SSL certificate issued to E7, which provides an illusion of legitimacy. According to VirusTotal, 1 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. Trust scores from various sources are low, indicating a high likelihood of malicious intent. The page title is simply "Captcha," which aligns with the observed phishing scheme.

As of the latest assessment, rab3.at remains active and continues to host the fake CAPTCHA page. Users who encounter this domain should avoid entering any information and close the page immediately. PhishDestroy recommends that organizations block this domain at the network level and educate users about CAPTCHA-based phishing tactics. If any credentials were inadvertently provided, they should be changed immediately and monitored for unauthorized use. Regular security awareness training can help users recognize such deceptive pages and report them to security teams.