kra2[.]at

This domain, kra2.at, was observed serving a page with the title “Nur einen Moment…”. The site was hosted behind Cloudflare, as indicated by the authoritative nameservers ali.ns.cloudflare.com and hans.ns.cloudflare.com and by the presence of Cloudflare Browser Insights and HTTP/3 support. The TLS certificate was issued by Google Trust Services under the WE1 label, confirming the use of Cloudflare’s default SSL termination. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Registration information lists Edomains LLC as the registrar, confirming a legitimate Austrian registrar channel.

At the time of analysis the web server responded with HTTP 403 and the domain status was recorded as offline. The domain has been added to a single security blocklist and is currently blocked by the PhishDestroy sinkhole. VirusTotal scans show that six of ninety‑three antivirus or URL‑reputation engines flagged the domain, indicating a moderate level of confidence that the site is malicious. No additional public threat‑intel sources such as OTX or Google Safe Browsing were provided. The available evidence points to a deliberately hosted phishing infrastructure that leverages Cloudflare’s CDN and SSL services to obscure the origin of the malicious payload.

The exact payload, target brand, or credential‑collection mechanism cannot be confirmed because the page content has not been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any future resolution changes, and consider adding the domain to internal blocklists. Ongoing surveillance of the IP address 188.114.97.3 is recommended, as Cloudflare customers often share the same edge nodes. Incident responders should also verify whether any internal users have attempted connections to this domain before it was taken offline.