kra1b1[.]at

The domain kra1b1.at was registered on 27 February 2026 through the registrar Gransy s.r.o., as listed in the Austrian NIC registry (registrar ID 609). Its authoritative nameservers are aaden.ns.cloudflare.com and asa.ns.cloudflare.com, directing traffic to Cloudflare’s network. DNS resolution returns the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. No TLS certificate is presented; HTTP requests return a 403 status, indicating that the web server is deliberately refusing access.

The page title presented by the host is the literal string “kra1b1.at”. The domain has been flagged by the PhishDestroy blocklist and appears on a single security blocklist at the time of analysis. VirusTotal reports that the domain was examined by 93 scanning engines, none of which raised a detection, though the absence of detections does not constitute a safety assurance. The current operational status is recorded as offline.

Analysis confirms that the domain’s infrastructure is typical of a Cloudflare‑proxied site used in phishing campaigns, but the lack of a valid SSL certificate and the HTTP 403 response suggest that the malicious payload may have been removed or the site is temporarily disabled. Uncertainty remains regarding the specific phishing content, target brand, or credential‑harvesting mechanism because the page body has not been captured. Defenders should continue to block connections to the domain at network perimeter, monitor for any re‑activation, and consider adding the domain to internal URL filtering lists. Ongoing observation of the associated IP block and the registrar’s activity is advised in case the infrastructure is reused for future campaigns.