krab6at[.]run

The domain krab6at.run was registered through NiceNIC International Group Co., Limited on 23 February 2026. DNS resolution points to 188.114.97.3, an address owned by Cloudflare, Inc. (ASN 13335) and served from the United States. The authoritative nameservers ali.ns.cloudflare.com and zahir.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s edge network, which also supplies HTTP/3 support and a Let's Encrypt certificate (issued to E8). An HTTP request to the base URL returns a 403 Forbidden status, indicating that direct access is being denied, and the site is currently marked as taken offline.

Security tooling has flagged the domain. Eight of ninety‑three VirusTotal scanners have reported malicious activity, and the domain appears on a single external blocklist. PhishDestroy has added the domain to its blocklist, and Gridinsoft’s trust scoring system assigns a rating of 0 out of 100, reflecting a high confidence of abuse. The page title returned from the server is "slon2.cc", which does not correspond to the domain name and is typical of obfuscated phishing infrastructure.

No additional content has been captured, so the exact payload or credential‑harvesting mechanism remains unknown. Given the combination of recent registration, Cloudflare‑based hosting, a low‑trust score, multiple vendor detections, and blocklist inclusion, the domain should be treated as a confirmed phishing threat. Defenders are advised to add krab6at.run to local deny lists, update intrusion‑prevention signatures, and monitor for any DNS or HTTP requests to the associated IP address. Continuous re‑evaluation is recommended in case the site becomes active again, and any observed traffic should be logged for further forensic analysis.