ktab6[.]at

This domain, ktab6.at, is flagged as an active phishing threat with a high-risk classification as of July 25, 2026. Infrastructure analysis reveals it resolves to IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States. The domain was registered on February 21, 2026, and remains operational, currently returning an HTTP 301 redirect status. Its page title, 'Captcha,' suggests an attempt to mimic a security verification process, a common tactic in phishing schemes to deceive users into interacting with malicious content. The domain is protected by Cloudflare nameservers (rayne.ns.cloudflare.com and rick.ns.cloudflare.com) and uses an SSL certificate issued by Google Trust Services (WE1), which does not inherently indicate legitimacy due to the widespread availability of free certificates.

Security vendor assessments are limited but concerning: Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist, specifically PhishDestroy. VirusTotal reports two detections out of 93 vendors, indicating early-stage recognition of the threat. The absence of additional detections does not imply safety, as phishing domains often evade initial scans before gaining broader visibility. No specific brand or scam type is confirmed in the available data, and the exact content of the site remains unanalyzed.

Defenders should treat ktab6.at as a confirmed phishing domain. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to its IP address (188.114.97.3), and alerting users to avoid interaction. Given its Cloudflare hosting, additional scrutiny of related domains using the same nameservers or IP range may uncover further malicious activity. The domain's recent registration and use of a generic 'Captcha' page title align with patterns observed in credential-harvesting or malware-distribution campaigns.