krab1[.]io

Analysis of krab1.io indicates the domain was provisioned on 4 December 2025 and is currently taken offline. The authoritative name servers are eva.ns.cloudflare.com and keanu.ns.cloudflare.com, pointing to Cloudflare’s network. DNS resolution returns the IP address 104.21.59.205, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate is presented, meaning the site served HTTP only or without encryption. The page title returned during the brief crawl was “Captcha”, providing no further context about the hosted content.

The domain is listed on a single security blocklist and has been flagged by the PhishDestroy service. VirusTotal reports that five out of ninety‑three scanners have identified the domain as malicious, reinforcing the suspicion of phishing activity. Reputation scoring from Gridinsoft assigns a zero out of one hundred, indicating a lack of trust. Registration details show the registrar as NiceNIC International Group Co., Limited.

No additional intelligence such as Safe Browsing alerts, OTX mentions, or known phishing kits is available. The combination of a recent creation date, Cloudflare front‑end, absence of TLS, low trust score, and multiple vendor detections suggests that krab1.io was used for a short‑lived phishing campaign that has now been taken down. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the IP address or associated name servers, and incorporate the indicator set (domain, IP, name servers) into threat‑intel feeds. Ongoing observation of the Cloudflare edge for new domains sharing the same infrastructure is advisable, as actors frequently recycle these resources.