krab6[.]at

Analysis of krab6.at as of July 25, 2026 confirms that the domain is actively used for phishing. The site returns an HTTP 301 redirect and is hosted behind Cloudflare, as indicated by the presence of Cloudflare Browser Insights and HTTP/3 support. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and the server presents a Let's Encrypt TLS certificate. The domain is registered with Cloudflare nameservers (peyton.ns.cloudflare.com and phoenix.ns.cloudflare.com).

VirusTotal reports a single detection out of 94 security vendors, and the domain appears on one external blocklist. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. PhishDestroy has already blocked the domain, confirming its classification as a phishing resource. The page title reported by the crawler is simply "krab6.at," providing no additional context about the targeted brand or campaign.

While the limited detection count suggests a low-profile operation, the combination of a low trust score, blocklist presence, and confirmed phishing classification indicates a high risk to users who may encounter the domain. Defenders should immediately add 188.114.97.3 and krab6.at to DNS and URL filtering policies, monitor outbound traffic for connections to the IP, and ensure that endpoint protection solutions are updated to recognize the single vendor detection. Continuous threat‑intel feeds should be consulted for any new indicators, and any internal phishing simulation tools should avoid using this domain to prevent accidental exposure.