krk47[.]at

This domain, krk47.at, is currently active and classified as a high‑risk crypto‑scam phishing site. VirusTotal records show that six of ninety‑five security vendors have flagged the domain as malicious, indicating a consensus among a subset of scanners. AlienVault OTX lists the domain in one threat‑intelligence pulse, and it appears on one public blocklist, confirming its presence in external reputation feeds. The site is served without an SSL certificate, returning HTTP status code 200 over clear‑text HTTP.

DNS resolution points to 172.67.222.128, an IP owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. Both authoritative nameservers, luke.ns.cloudflare.com and rosalie.ns.cloudflare.com, are Cloudflare‑managed, which is consistent with the hosting provider identified by the IP address. The registrar information shows registration through Hosting Concepts B.V. d/b/a Registrar.eu, but no further registration timestamps are provided. The page title observed on the landing page reads “Krа47.at | Krа47.cc - Проверка браузера”, which is the only content‑level indicator available; no additional page analysis has been performed.

Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain is already blocked by the PhishDestroy service, and it has been cited as a crypto‑scam in the available intelligence. Defenders should add krk47.at to network and endpoint blocklists, enforce HTTPS inspection to capture any future encrypted traffic, and monitor Cloudflare‑related DNS queries for the associated IP. Continuous re‑evaluation is advised, as the lack of SSL and the simple HTTP response suggest the site could be leveraged for credential harvesting or cryptocurrency‑related fraud, but the exact payload and victim interaction remain unverified.