kraa47[.]at

Analysis of the domain kraa47.at indicates it was operating as a generic phishing gateway, likely leveraging a Captcha page as an evasion or filtering mechanism. The domain resolved to IP address 172.67.155.46, hosted on Cloudflare's infrastructure (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (adel.ns.cloudflare.com and jihoon.ns.cloudflare.com), alongside Cloudflare Browser Insights and HTTP/3, suggesting an attempt to obscure origin and enhance delivery speed or resilience. The domain was registered on February 21, 2026, and by July 24, 2026, it had been flagged by one security vendor on VirusTotal and appeared on a single blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as malicious.

The SSL certificate was issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites due to its free availability. At the time of assessment, the domain returned an HTTP 403 status, indicating access was forbidden, and it was confirmed offline. The page title, 'Captcha,' aligns with phishing campaigns that use such pages to filter automated analysis tools or to lend a false sense of legitimacy. However, the exact target or brand being impersonated remains unconfirmed, as no additional evidence of a specific scam type or kit was provided.

Defenders should treat this domain as a confirmed phishing indicator, particularly in environments where Captcha-based gateways are used to bypass security controls. While detection coverage remains low (1/93 vendors), the combination of Cloudflare hosting, recent registration, and a trust score of zero warrants blocking at the DNS or proxy level. Further investigation into related infrastructure, such as co-hosted domains on 172.67.155.46 or domains sharing the same nameservers, may uncover additional malicious activity.