kra54[.]at

The domain kra54.at was a generic phishing site designed to deceive users into disclosing sensitive information such as login credentials or personal data. It did not impersonate a specific brand or employ a known drainer kit. As of the latest verification, kra54.at has been taken offline, though its prior activity posed an elevated risk to visitors.

Technical analysis of kra54.at revealed limited detection, with 1 of 95 VirusTotal security vendors flagging the domain. The domain was registered through Edomains LLC on March 23, 2026, and resolved to the IP address 104.21.13.129, hosted by Cloudflare in Canada. It appeared on 1 security blocklist (PhishDestroy) and used Cloudflare nameservers (mack.ns.cloudflare.com and sky.ns.cloudflare.com). The SSL certificate was issued by Google Trust Services, and the observed page title was 'Just a moment...'. Technologies detected included Node.js, Express, and Cloudflare services.

Users who may have interacted with kra54.at should take immediate steps to secure their accounts. If login credentials were entered, change passwords for all affected accounts and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity and report any suspected fraud to financial institutions or relevant platforms. To report the phishing domain, submit it to Google Safe Browsing, PhishTank, or local cybersecurity authorities for further investigation.