at-krab1[.]cc

PhishDestroy identifies at-krab1.cc as an active fake Krab application phishing domain designed to deceive users into downloading malicious software under the guise of a legitimate application.

This domain was flagged with a risk level of under_investigation due to its clear intent to impersonate a popular app, despite operating with a recently created domain registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on December 11, 2025. The domain resolves to IP 104.21.76.143 and currently shows 0 detections out of 95 VirusTotal scans, indicating it has evaded immediate detection. The presence of an SSL certificate issued by Google Trust Services may further lend false credibility to the site, as malicious actors increasingly exploit trusted certificate authorities to appear legitimate.

Users are strongly advised to avoid interacting with at-krab1.cc due to the high risk of credential theft or malware infection. To mitigate exposure, immediately block the domain and IP address 104.21.76.143 at the network level. Verify any application downloads directly from official sources and educate users to recognize red flags such as recent domain registrations and unexpected SSL certificates. Report the domain to relevant threat intelligence platforms to aid in broader detection and takedown efforts.