krab5-at[.]com

This domain, krab5-at.com, has been assessed as an elevated risk for a specific threat type: fake login phishing. The domain has been taken offline, but prior analysis indicates significant indicators of phishing activity.

The domain is flagged by 5 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.146.189. The domain was created on March 27, 2026, and appears on one security blocklist, specifically PhishDestroy. Additionally, the domain has a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trust. An SSL certificate issued by Google Trust Services is associated with the domain, which might be used to gain user trust. The domain was also found in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious nature.

To mitigate the risk posed by this fake login phishing domain, it is recommended that organizations and individuals update their security policies to block access to the domain and its associated IP address. Users should be educated on recognizing phishing attempts, including verifying the URL and SSL certificate before entering any credentials. Network administrators should also monitor for any signs of the domain reappearing and implement additional layers of security, such as DNS filtering and email gateway protection, to prevent phishing attempts from reaching users.