xn--krb2-roa[.]at

The domain xn--krb2-roa.at is currently classified as high‑risk credential phishing and remains active as of the report date. The hosted page presents the title “krab5.cc”, which is inconsistent with the domain name and is typical of credential‑harvesting sites. The site serves HTTP status code 200, indicating a fully operational web service. DNS resolution points to the IP address 188.114.96.3, owned by a large content‑delivery network based in Canada. The domain is delegated to the authoritative nameservers keenan.ns.cloudflare.com and sunny.ns.cloudflare.com, confirming use of the same CDN for DNS and web delivery. TLS is provided via a free certificate authority, resulting in a valid HTTPS endpoint. Security intelligence shows the domain appears on one public blocklist and has been flagged by 13 of 95 scanners on a major malware aggregation service. The site is listed by an additional phishing‑focused blocklist. A trust‑scoring engine assigns a score of 0 out of 100, reflecting extreme malicious confidence. Detected technologies include HTTP/3 and a browser‑insights module supplied by the CDN provider. Defenders should immediately block traffic to xn--krb2-roa.at at the network perimeter and incorporate the domain into email filtering rules to prevent credential‑phishing payloads. Continuous monitoring of DNS queries for the listed nameservers can provide early warning of related infrastructure reuse. Given the active status, periodic re‑evaluation is advised to capture any changes in hosting or certificate details.