krab4[.]art

Analysis conducted on July 25, 2026 identifies the domain krab4.art as part of an elevated‑risk generic phishing infrastructure. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. DNS resolution shows the authoritative nameservers are dakota.ns.cloudflare.com and elle.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services for rapid deployment and potential abuse of its edge network. No SSL certificate was observed for the domain, meaning traffic is not encrypted and may be intercepted or altered by an attacker.

The sole visible page title returned by HTTP requests is “Captcha,” providing no substantive indication of the malicious payload or targeted brand. Current status shows the site has been taken offline, but historical records indicate it was listed on at least one security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans report that two of ninety‑five scanning engines flagged the domain, suggesting some detection of malicious characteristics, though the majority of engines did not raise alerts. The limited visibility of the landing page and the absence of additional metadata prevent a full attribution of the phishing kit or the exact victim profile.

Defenders should continue to monitor the domain’s DNS and IP reputation, enforce blocking of traffic to 188.114.97.3 for any krab4.art queries, and add the domain to internal deny lists. Organizations using threat‑intelligence feeds are advised to incorporate the observed indicators—registration date, registrar, IP address, Cloudflare nameservers, and the “Captcha” page title—into their detection rules. Ongoing vigilance is recommended, as the infrastructure could be repurposed for future campaigns should the operators reactivate the domain or shift to similar Cloudflare‑hosted assets.