krab28[.]at

Analysis of krab28.at, observed on July 25, 2026, indicates a high‑risk generic phishing operation that remains active. The domain resolves to 104.21.88.36, an IP owned by Cloudflare (AS13335) located in the United States, and is served through Cloudflare’s edge network using technologies such as Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Let’s Encrypt, providing a valid HTTPS connection but offering no assurance of legitimacy. The site’s page title is identical to the domain name, "krab28.at," and the HTTP response is a 301 redirect, suggesting that visitors are forwarded to another location, a common tactic in phishing campaigns.

Reputation data is poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. VirusTotal reports that 2 of 94 security vendors have flagged the domain, and PhishDestroy has explicitly blocked it. Nameservers are peyton.ns.cloudflare.com and phoenix.ns.cloudflare.com, both Cloudflare‑managed, which further obscures the underlying hosting environment.

While the exact content of the landing page has not been disclosed, the combination of a low trust score, blocklist presence, vendor detections, and a redirect response strongly supports the classification as a phishing site. Defenders should immediately block krab28.at at the DNS level, add its IP address 104.21.88.36 to network‑level deny lists, and monitor outbound traffic for any attempts to resolve or connect to the domain. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this domain, and any associated redirects should be investigated for downstream malicious payloads.