krakn19at[.]com

The domain krakn19at.com was registered on March 27 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is hosted on Cloudflare nameservers daphne.ns.cloudflare.com and marty.ns.cloudflare.com and resolves to the IPv4 address 52.201.53.166. The domain age of less than four months aligns with typical rapid‑deployment campaigns used for credential harvesting.

VirusTotal analysis shows that three of ninety‑five scanning engines have flagged the domain as malicious, indicating a modest but non‑trivial detection consensus. The domain is listed on a single security blocklist and has been explicitly blocked by a known phishing blocklist. AlienVault OTX records the domain in twenty‑one separate threat‑intel pulses, reinforcing its association with phishing infrastructure.

The HTTP response for krakn19at.com returns a 404 status code, which may be used to hide malicious landing pages or to serve content only after specific client‑side triggers. Combined with the active block status, the high risk rating, and the presence on multiple intelligence feeds, the observable indicators strongly suggest that the domain is being leveraged for credential harvesting operations targeting unsuspecting users.

Defenders should add krakn19at.com to deny‑list rules at perimeter and endpoint controls, and also block its resolved address 52.201.53.166 to prevent any inadvertent connections. Continuous monitoring of DNS queries for the domain and its Cloudflare nameservers is advised, as well as correlation of any observed authentication attempts with the listed OTX pulses to identify potential victimization.