crabsfurie[.]com

Analysis of crabsfurie.com, created on September 25, 2025 and registered through Tucows Domains Inc., shows a consistent pattern of malicious activity associated with account takeover attempts. The domain resolves to the IPv6 address 2a04:2180:dc05:c108::89, which is geo‑located in Lithuania and assigned to AS61272 Informacines sistemos ir technologijos, UAB. Hosting is indicated by the dual name‑server configuration dns1.bacloud.com, dns1.laisvas.lt, dns2.bacloud.com, and dns2.laisvas.lt, suggesting a multi‑provider setup that may be used to increase resilience against takedown efforts. No TLS certificate is present, leaving the site accessible only via clear‑text HTTP, which is typical for low‑effort phishing deployments that rely on rapid domain turnover.

The page title returned by the server is "Account Suspended," implying that the site has been taken offline, a status confirmed at the time of reporting. Despite the offline state, the domain appears on two independent security blocklists—PhishDestroy and ScamSniffer—providing external validation of its malicious intent. VirusTotal scans indicate that three out of ninety‑five AV engines flagged the domain, reinforcing the suspicion raised by the blocklist entries.

Given the elevated risk rating, defenders should proactively block the IPv6 address and associated name‑servers at network perimeters, add crabsfurie.com to local allow‑list exclusions, and monitor for any resurgence of activity under the same registration details. Continuous re‑evaluation is advised, as threat actors frequently recreate infrastructure after takedown, potentially reusing the same registrar or name‑server pattern. Organizations should also educate users about unsolicited account‑verification requests, as the observed scam type aligns with account takeover phishing campaigns.