krab27[.]pro

Analysis conducted on July 29, 2026 identifies krab27.pro as an active phishing domain targeting user credentials. The domain appears on one security blocklist, specifically PhishDestroy, indicating prior classification as malicious. VirusTotal telemetry reports that six of ninety-one security vendors flag krab27.pro as harmful, though the precise detection signatures and family labels remain undisclosed. No additional blocklist, Safe Browsing, or Open Threat Exchange records are currently linked to this infrastructure.

Infrastructure analysis reveals that the domain was registered through a privacy-protected registrar, obscuring beneficial ownership. Hosting is provisioned on a single IPv4 address, though the autonomous system number and geolocation data are not publicly confirmed. The site returns an HTTP 200 status, suggesting an operational phishing landing page, but the exact page title and targeted brand are not yet analysed. No SSL certificate thumbprints or associated phishing kits are documented in available threat feeds.

Defenders are advised to treat krab27.pro as an elevated-risk domain based on the existing detection volume and blocklist inclusion. Network-level blocking at the DNS or IP layer is recommended pending further behavioural analysis. Security teams should correlate logs for connections to this domain and examine endpoint telemetry for credential-harvesting activity linked to krab27.pro. Further investigation is required to determine the specific brand impersonated and the lifecycle stage of this campaign.