kra12[.]at

Analysis of kra12.at shows that the domain is currently taken offline, returning HTTP 403 for all requests. The host resolves to IP 193.32.204.5, which is geolocated to Turkey and is associated with the Vigilant Cyber network. The site is listed on one public security blocklist and has been actively blocked by the PhishDestroy sinkhole, indicating prior malicious use. VirusTotal scans report that four of ninety‑one AV engines flagged the domain, reinforcing the suspicion of abuse. The TLS certificate presented is issued by Let’s Encrypt under the identifier YE2, a common choice for short‑lived malicious infrastructure. No additional page content, brand targeting, or kit information is available in the current intelligence set, so the exact phishing payload or victim profile remains unknown. Defenders should add kra12.at and its resolved IP address to outbound and inbound deny lists, monitor DNS queries for the domain, and consider correlating any recent authentication attempts from the same IP range with credential‑theft indicators. Continuous re‑scanning of the domain is advised in case it is re‑hosted, and any future detections should be shared with threat‑sharing communities to improve collective visibility.