kra98[.]at

Analysis of the domain kra98.at, created on February 27 2026, shows a typical infrastructure for a generic phishing operation. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is hosted in the United States. DNS resolution is served by the Cloudflare nameservers deborah.ns.cloudflare.com and rene.ns.cloudflare.com, indicating the use of Cloudflare’s CDN and security services. HTTP requests return a 403 status code, suggesting that the site is currently inaccessible or deliberately restricting access, and the server advertises support for HTTP/3.

The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming the presence of a valid SSL certificate. The page title returned from the site is simply "kra98.at," providing no additional context about the content. The domain was registered through Edomains LLC, as listed in the Austrian NIC registry. Reputation checks show the domain appears on one security blocklist and has been flagged by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records indicate the site was scanned by 93 antivirus engines with no detections reported, though the lack of detections does not imply benign intent. Given the observed infrastructure—recent registration, Cloudflare hosting, a valid SSL certificate, and inclusion on a phishing blocklist—defenders should treat kra98.at as a malicious phishing resource. Recommended actions include adding the domain to internal blocklists, monitoring DNS queries for the associated IP, and reviewing any recent logs for connections to the domain or its IP address. Further investigation is needed to determine the exact phishing campaign details, target demographics, and any associated payloads, as the current evidence is limited to infrastructure observations.