krab5-at[.]net

This domain is flagged as an elevated-risk generic phishing resource specifically designed to replicate the legitimate krab5.at authentication portal. Analysis indicates the infrastructure is engineered to deceive users into submitting sensitive login credentials through visually identical spoofed interfaces, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals the domain krab5-at.net was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. The domain resolves to the IP address 188.114.97.3 and is currently blocked by at least one security blocklist. Detection metrics show 5 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The site employs Cloudflare Browser Insights and HTTP/3 protocols, leveraging Cloudflare’s infrastructure to obscure its true origin. The SSL certificate is issued by Google Trust Services, further complicating detection by blending in with legitimate traffic. Mitigation against this specific threat involves immediate domain blacklisting at the network perimeter, particularly for any resolution attempts to 188.114.97.3. Organizations should deploy endpoint protection rules to block access to newly registered domains from high-risk registrars, such as NICENIC INTERNATIONAL GROUP CO., LIMITED. User awareness training should emphasize scrutinizing domain names for subtle typos or appended segments, as seen in the transition from krab5.at to krab5-at.net. Additionally, monitoring for anomalous outbound connections to Cloudflare-hosted IPs associated with low-reputation domains can help identify compromised endpoints attempting to exfiltrate credentials.