krab9x[.]cc

PhishDestroy identifies krab9x.cc as an active crypto drainer phishing domain targeting cryptocurrency users. This domain, registered on December 12, 2025, has been confirmed as a threat and remains active as of the latest analysis. The domain is designed to trick users into connecting their wallets or entering private keys, resulting in unauthorized cryptocurrency transfers. This domain was flagged by 3 of 95 VirusTotal security vendors, indicating low initial detection but rising suspicion. It resolves to IP address 188.114.96.3 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for both legitimate and malicious domain registrations. The domain holds an SSL certificate issued by Google Trust Services, which may be leveraged to appear legitimate and evade user suspicion. Given the elevated risk level and active status, users are strongly advised to avoid accessing krab9x.cc or any associated subdomains. Security teams should block the domain and IP at the network level and monitor for related infrastructure. If accidental interaction occurs, disconnect wallets immediately, revoke any connected permissions, and report the domain to relevant authorities such as Google Safe Browsing, PhishTank, or local cybersecurity agencies. Proactive threat intelligence sharing can help prevent further exploitation of this and similar crypto drainer domains.