krab17[.]at

Analysis of the domain krab17.at indicates that it was registered on March 31, 2026 and is currently taken offline, returning an HTTP 403 status code. The domain resolves to the IP address 86.54.24.57, which is associated with a hosting location in Latvia (LV). The TLS certificate presented is issued by Let’s Encrypt and is identified as version E7, confirming that encrypted connections are possible despite the site being inaccessible.

Threat intelligence sources show that the domain appears on a single security blocklist and has been blocked by the PhishDestroy service, suggesting that it was identified as malicious by at least one defensive platform. VirusTotal recorded a single positive detection out of 94 contributing security vendors, providing limited but concrete evidence of malicious behavior. Additionally, AlienVault OTX lists the domain in one threat‑intelligence pulse, reinforcing the suspicion of phishing use.

No further details such as page title, brand targeting, or kit attribution are available, leaving the exact phishing payload and victim profile uncertain. Defenders should continue to block the domain and its associated IP, monitor for any resurgence of activity, and consider adding the IP to network‑level deny lists. Ongoing surveillance of related blocklists and threat‑intel feeds is recommended to capture any future re‑use of the infrastructure.