crab-4[.]cc

This domain is flagged as a high-risk crypto wallet drainer, designed to execute unauthorized transactions from victims' cryptocurrency wallets. Analysis indicates the infrastructure is actively targeting users through deceptive prompts that mimic legitimate wallet interfaces, enabling attackers to siphon funds upon interaction. The threat type is highly specific: credential theft combined with automated transaction manipulation, commonly referred to as a 'drainer' in cryptocurrency security contexts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to IP address 188.114.97.3 and employs Cloudflare with HTTP/3 support, alongside a Let's Encrypt SSL certificate. Detection metrics show 11 out of 95 security vendors on VirusTotal have flagged the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on three distinct security blocklists, including MetaMask and SEAL, indicating widespread recognition of its malicious intent. The page title 'Just a moment...' is consistent with cloaking techniques used to evade automated detection systems. Mitigation requires immediate action from both users and network administrators. Users should verify all transaction prompts by cross-referencing wallet addresses through trusted sources before approval. Wallet software should be configured to disable automatic script execution and enable transaction simulation features where available. Network-level protections should include DNS filtering to block resolution of crab-4.cc and its associated IP 188.114.97.3. Organizations should monitor for connections to this domain in proxy logs and implement strict content security policies to prevent unauthorized script loading from external sources. Given the domain's recent creation date and active status, continuous monitoring for related infrastructure is recommended.