crab1[.]at

This domain, crab1.at, was observed hosting a generic phishing page with the title “Nur einen Moment…”. The site resolved to the IP address 188.114.97.3, which is advertised as belonging to AS13335 Cloudflare, Inc. in the United States. Registration details indicate the domain was created through Key‑Systems GmbH, as shown on the Austrian NIC registrar page. Cloudflare’s authoritative name servers “elisa.ns.cloudflare.com” and “wells.ns.cloudflare.com” were in use at the time of capture. The HTTPS certificate presented to visitors listed “PhishDestroy / botadmin.destroy.tools”, confirming a deliberate attempt to associate the site with the PhishDestroy blocklist.

An HTTP GET returned status code 200, suggesting the page was actively serving content before the takedown. VirusTotal scans recorded seven positive detections out of ninety‑three submitted engines, reinforcing the malicious classification. The domain appears on one external security blocklist and is explicitly blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, indicating a complete lack of benign reputation. The current operational status is offline, and the site has been taken down.

Defenders should continue to block traffic to 188.114.97.3 and to the domain name crab1.at at DNS and proxy layers, even though the site is presently offline, because the hosting infrastructure may be reused for future campaigns. Monitoring of Cloudflare‑hosted IP ranges for similar patterns and periodic re‑scanning of the domain on multi‑engine platforms are recommended. Additionally, updating endpoint and email security policies to flag URLs that resolve to the same certificate subject or that use the same page title can help catch repeat attempts. No further technical artifacts, such as payloads or command‑and‑control endpoints, have been disclosed, so the threat remains limited to credential‑harvesting phishing activity.