krk4[.]at

PhishDestroy first observed krk4.at on Dec 22, 2025. The captured page title is “kra46.at, kra47.at, krab1.at”. Current evidence score: 85/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and DNS security resolvers. VirusTotal recorded 7 detections among 93 engines: ADMINUSLabs, alphaMountain.ai, CRDF, CyRadar, Forcepoint ThreatSeeker, SOCRadar, Webroot on Feb 25, 2026 at 02:23 UTC. DNS security checks returned 10 blocking results across 14 tested policies: Adguard Default, Adguard Family, Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Family, Control D Malware, Mullvad Adblock, Opendns Standard, Quad9 Secure; no observation timestamp was retained. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:27 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:30 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:19 UTC; content was unavailable. Registration records for the domain list Hosting Concepts B.V. d/b/a Registrar.eu as the registrar. At collection time, the hostname resolved to 188.114.96.3 on AS13335 (CLOUDFLARENET, US). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. DOM analysis on Mar 11, 2026 at 09:20 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists botadmin.destroy.tools as the certificate issuer with validity through Jan 6, 2036; checked Mar 12, 2026 at 01:32 UTC.

The content indicators and 2 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.