kran11[.]at

Analysis as of July 24 2026 indicates that the domain kran11.at is currently offline and returns HTTP 403 for all requests. The domain was registered on 27 February 2026 through the Austrian registrar Gransy s.r.o. and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers bella.ns.cloudflare.com and quentin.ns.cloudflare.com. No TLS certificate is presented, confirming the absence of HTTPS support.

The page title reported by a crawler is “kran11.at”, matching the domain name itself; no additional content has been observed. The domain appears on a single public security blocklist and has been flagged by the PhishDestroy feed, confirming that at least one external threat‑intelligence source classifies it as malicious. VirusTotal has processed the domain with 93 scanning engines, none of which reported a detection at the time of analysis. While the lack of detections does not imply safety, it does indicate that no known malware signatures or phishing templates were identified by the examined vendors.

Given the limited evidence, the primary indicators of compromise are the recent registration date, the use of Cloudflare’s shared hosting, the absence of TLS, the 403 response, and inclusion on a blocklist. The exact payload, target brand, or victim interaction flow remains unknown because no page content has been captured. Defenders should continue to block kran11.at at perimeter and DNS filters, monitor for any future resolution changes, and consider adding the domain to internal watchlists. Ongoing observation of the IP address and associated Cloudflare customer identifiers is advised, as the infrastructure could be repurposed for other malicious campaigns.