grabber[.]fleshcloudcrm[.]xyz

This domain, grabber.fleshcloudcrm.xyz, was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The site resolves to the Cloudflare‑owned address 172.67.158.225, which is advertised as being located in the United States under ASN 13335 (Cloudflare, Inc.). Both authoritative nameservers, bingo.ns.cloudflare.com and konnor.ns.cloudflare.com, are Cloudflare‑managed, indicating that the attacker leveraged the provider’s CDN for anonymity and resilience. No TLS certificate is presented, meaning the service operates over plain HTTP, which can aid traffic interception but also signals a low‑cost setup.

The page title returned from the live capture reads “Facebook Grabber – Panel 2FA”, confirming a direct reference to Facebook and suggesting the use of a two‑factor authentication prompt to lure victims. The campaign is linked to the publicly‑available Airdrop Scam phishing kit, a modular toolkit frequently repurposed for social‑media credential harvesting. VirusTotal scans show that three of ninety‑three AV engines flagged the domain, providing limited but corroborating evidence of malicious intent. The domain has been listed on one security blocklist and was actively taken down by the PhishDestroy takedown service, with its current status reported as offline.

The elevated risk rating reflects the combination of brand impersonation, the use of a known phishing kit, and the presence of a dedicated IP address that could be reused in future operations. Defenders should add the domain and its resolving IP to blocklists, enforce DNS‑level sinkholing, and monitor for any resurgence of the same Airdrop Scam kit targeting Facebook users. Continuous review of Cloudflare‑associated IP ranges for similar activity is advised, as the provider’s infrastructure can host multiple unrelated malicious campaigns.