crabfun[.]app

PhishDestroy identifies crabfun.app as an active brand impersonation phishing domain designed to deceive users into divulging sensitive information under false pretenses. This domain mimics legitimate services to exploit trust, potentially leading to credential theft or financial fraud. The site leverages a recently issued SSL certificate from Let's Encrypt to appear legitimate, tricking users into believing the connection is secure. Early analysis suggests the threat actor is actively operational, as the domain remains unflagged by most detection engines despite its malicious intent. This domain was flagged by PhishDestroy after appearing on 1 security blocklist, with VirusTotal currently recording 0 detections out of 95 engines. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 21, 2026, and resolves to the IP address 188.114.96.3. The combination of recent registration, low detection rates, and blocklist inclusion indicates a newly deployed threat that evades conventional security measures. Threat actors often use registrars like NICENIC to obfuscate ownership due to lax enforcement of abuse policies. Users who visited crabfun.app should immediately scan their devices for malware, clear cached credentials, and avoid re-entering any sensitive information on the site. If any data was submitted, reset passwords for affected accounts and enable multi-factor authentication. Report the domain to security teams or platforms like PhishDestroy to aid in blocking efforts. Monitor financial accounts for unauthorized transactions and consider using identity theft protection services if sensitive details were exposed.