krk45[.]at

On July 25, 2026 the domain krk45.at was observed returning HTTP 200 with the page title “!!! РАБОЧЯЯ ССЫЛКА НА ВХОД == KRAB1.CC || KRAB1.AT”. The title is in Cyrillic and references KRAB1.CC and KRAB1.AT, suggesting the site was intended to serve as a gateway for credential collection targeting the KRAB1 service. The site was hosted behind Cloudflare infrastructure (AS13335) and resolved to 188.114.96.3, a Cloudflare edge address located in the United States. The SSL certificate presented for the host was issued to “PhishDestroy / botadmin.destroy.tools”, an identifier commonly associated with phishing‑related takedown or monitoring operations, indicating that the domain was likely used in a phishing campaign.

VirusTotal scanned the site and recorded four detections out of ninety‑three scanners, confirming that at least a subset of security products recognized malicious behavior. The domain appears on a single public blocklist and was also flagged by the PhishDestroy blocklist, reinforcing its classification as a phishing resource. Registration information shows the domain was registered through Hosting Concepts B.V. operating as Registrar.eu, but no further registrant details are disclosed. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. Nameserver records point to luke.ns.cloudflare.com and rosalie.ns.cloudflare.com, consistent with the observed Cloudflare hosting.

The site is currently taken offline, but the historical evidence suggests a brief active period. Uncertainty remains regarding the exact content served, the specific phishing kit employed, and whether any victim data was harvested before takedown. Defensive recommendations include adding krk45.at to network and email blocklists, monitoring for any residual DNS or IP activity, and reviewing logs for connections to the Cloudflare IP address and the associated nameservers.