krab24-at[.]cc

This domain is flagged as an elevated-risk credential theft phishing site targeting users through deceptive authentication prompts. Analysis indicates the infrastructure was designed to harvest login credentials by impersonating legitimate verification processes, such as CAPTCHA challenges, to lower user vigilance. Infrastructure analysis reveals the domain krab24-at.cc resolves to IP address 188.114.96.3, hosted behind Cloudflare infrastructure in Canada. It was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain is currently offline but was previously detected by 17 out of 95 security vendors on VirusTotal, with one active blocklist entry. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to appear legitimate while masking malicious intent. Mitigation requires immediate action from network administrators and end-users. Organizations should block the domain and its associated IP (188.114.96.3) at the perimeter firewall and DNS level. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, prioritizing accounts with financial or sensitive data access. Security teams should monitor for anomalous authentication attempts, particularly those originating from the identified IP range. Domain registration monitoring tools should flag future domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED for enhanced scrutiny.