krab-15[.]cc

Analysis of krab-15.cc indicates that the domain was actively used for a generic phishing campaign before being taken offline. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 28, 2026 and is hosted on Cloudflare DNS, as shown by the authoritative nameservers asa.ns.cloudflare.com and bob.ns.cloudflare.com. VirusTotal scans recorded three detections out of ninety-four security vendors, confirming that at least a subset of scanners recognized malicious activity associated with the domain.

HTTP probing returned a 403 status code, suggesting that direct access to the site is currently denied, which aligns with the reported offline status. The domain has been blocked by the PhishDestroy remediation service and appears on a single public security blocklist, reinforcing the consensus that it was part of a phishing infrastructure. While the exact phishing kit, targeted brand, and payload details remain unknown due to the lack of publicly available page content, the combined indicators—registrar information, recent creation date, Cloudflare nameservers, multiple vendor detections, and active blocking—provide sufficient confidence to classify the domain as a confirmed phishing threat.

Defenders should ensure that any internal DNS resolvers or proxy filters block krab-15.cc, update intrusion detection signatures to include the domain, and monitor for any resurgence or related domains that share the same registrar or nameserver configuration. Continuous review of threat feeds for new detections linked to the same infrastructure is advised, as adversaries may re‑register similar domains to resume the campaign.