crab2[.]at

This domain, crab2.at, operates as a credential harvesting phishing site designed to mimic a legitimate online retail platform. The page title, 'Официальный сайт krab2.at: вход в магазин - krab2.at и crab2.cc,' explicitly presents itself as an official login portal, likely targeting Russian-speaking users. Analysis indicates the site is engineered to collect login credentials, payment details, or other sensitive information under false pretenses, posing a direct risk of account compromise and financial fraud. Infrastructure analysis reveals the domain is flagged by 4 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100, indicating high confidence in its malicious classification. The domain resolves to the IP address 104.21.25.198, a Cloudflare-hosted endpoint commonly leveraged to obfuscate origin servers and evade takedowns. Registrar details confirm Cloudflare as the provider, a frequent choice for phishing operators due to its privacy protections and rapid deployment capabilities. The domain appears on at least one security blocklist, further corroborating its malicious intent. Users who have interacted with crab2.at should immediately cease all engagement and take corrective actions. If credentials were entered, reset passwords for all associated accounts, particularly those sharing the same or similar login details. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial statements and transaction histories for signs of fraudulent activity, and report any suspicious charges to the relevant institution. For enterprise environments, block the domain and IP address at the network level to prevent further exposure. Security teams should conduct a thorough review of endpoint logs to identify any compromised systems that may have interacted with the phishing infrastructure.