krab5at[.]at

This domain, krab5at.at, was registered on 21 February 2026 through Key-Systems GmbH and resolves to 104.21.14.207, an address owned by Cloudflare (AS13335, United States). The site returns HTTP 200 and presents the page title “KRAKEN”, matching the targeted brand Kraken. The certificate presented is issued by a recognized authority and validates the host name. The domain is classified as a crypto‑scam that impersonates Kraken, and it appears on three security blocklists. Four of ninety‑three VirusTotal scanners have flagged the domain as malicious. Infrastructure analysis shows the use of Cloudflare Browser Insights and HTTP/3, indicating reliance on Cloudflare’s edge network to hide the origin server. The Gridinsoft trust score is 0/100, reinforcing the malicious assessment. The threat is currently active and assigned a high risk rating. Defenders should immediately block traffic to krab5at.at at the DNS and network layers, add the address 104.21.14.207 to outbound filtering rules, and monitor for any newly registered domains that resolve to the same Cloudflare edge IP range and reference the Kraken brand. Continuous observation of Cloudflare‑hosted infrastructure for similar page titles or brand references is advised, as the attacker can rapidly deploy additional domains under the same service. Incident response teams should also correlate internal logs for any attempted connections from internal users to this domain, especially those involving cryptocurrency wallets or exchange services, and treat such activity as compromised.