krab-2cc[.]com

This domain, krab-2cc.com, is identified as a credential phishing site targeting users through generic phishing tactics. Analysis of the page title, "Актуальная ссылка - krab2.cc," suggests an attempt to impersonate or redirect to a secondary domain (krab2.cc), likely part of a broader phishing campaign. No specific brand impersonation or drainer kit signatures were confirmed, but the domain exhibits characteristics consistent with credential harvesting infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.162.57 and was registered through NiceNIC International Group Co., Limited. It was created on February 21, 2026, an anomalous date likely indicative of incorrect WHOIS data or domain squatting. The domain is flagged by 7 out of 95 security vendors on VirusTotal and appears on one security blocklist. It employs Cloudflare for hosting and uses HTTP/3, while its SSL certificate is issued by Google Trust Services. The domain currently holds a Gridinsoft trust score of 0/100 and is explicitly blocked by PhishDestroy. As of the latest assessment, krab-2cc.com has been taken offline, reducing immediate exposure risk. However, the infrastructure (e.g., IP, registrar, and associated domains) may still pose residual threats. Users who accessed the domain prior to its takedown should assume credential compromise and initiate password resets for any accounts linked to the site. Network administrators are advised to block the domain and its resolving IP at the perimeter, monitor for related indicators, and review logs for prior connections. The anomalous creation date and use of Cloudflare suggest potential obfuscation tactics, warranting continued vigilance for similar domains.