crab-3[.]cc

This domain is flagged as an elevated-risk brand impersonation threat designed to mimic the Kraken cryptocurrency exchange platform. Analysis indicates the infrastructure is specifically engineered for credential harvesting or crypto asset theft, leveraging the recognized Kraken brand to deceive users into submitting login credentials or wallet access details. The page title 'KRAKEN' and visual design likely replicate legitimate Kraken interfaces to lower user suspicion during interaction. Infrastructure analysis reveals the domain crab-3.cc was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive domains. It currently resolves to IP address 172.67.175.204 and presents an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy. The domain appears on three security blocklists and is detected by 7 out of 95 security vendors on VirusTotal, including multiple phishing and malicious site classifications. Despite its current offline status, historical records confirm its use in active phishing campaigns. To mitigate risks associated with this threat type, users should verify domain authenticity by cross-referencing official exchange URLs and checking for subtle misspellings or irregular top-level domains. Enable multi-factor authentication on all cryptocurrency accounts to prevent unauthorized access even if credentials are compromised. Organizations should update web filtering policies to block domains registered through high-risk registrars and monitor for SSL certificates issued to newly created domains impersonating financial services. Security teams are advised to review logs for connections to 172.67.175.204 and correlate with user reports of suspicious login attempts.