krab2-cc[.]com

Analysis indicates that krab2-cc.com is an active credential-phishing domain targeting users of the legitimate service krab2.cc. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 188.114.97.3, which is part of CloudFlare’s infrastructure in Canada. The use of CloudFlare nameservers (aleena.ns.cloudflare.com and jay.ns.cloudflare.com) and a 301 HTTP redirect suggests an attempt to mask the true origin of the phishing infrastructure while maintaining operational persistence. The domain is flagged by one threat intelligence pulse in AlienVault OTX and appears on a security blocklist, specifically PhishDestroy. Gridinsoft assigns it a trust score of 0/100, reinforcing its classification as high-risk. The SSL certificate, issued by Google Trust Services (WE1), is consistent with legitimate sites but does not mitigate the threat, as phishing domains frequently use valid certificates to appear credible. VirusTotal reports that 4 of 94 security vendors detect this domain as malicious, though the absence of additional context limits the granularity of this assessment. The page title, 'krab2.cc,' directly corresponds to the targeted service, indicating an intent to deceive users into believing they are interacting with the authentic platform. No specific phishing kit or brand impersonation details are available in the current intelligence, but the domain’s structure and behavior align with credential-harvesting campaigns. Defenders should treat this domain as actively malicious and implement blocking measures at the DNS or proxy level. Further investigation into the redirect chain and backend infrastructure may reveal additional indicators of compromise, such as associated IP ranges or connected domains.