krab2web[.]xyz

The domain krab2web.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative name servers ali.ns.cloudflare.com and zahir.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s reverse‑proxy service. No TLS certificate is presented, indicating that the site does not serve HTTPS content. HTTP requests return an offline status at the time of analysis, and the page title returned by the server is “krab5.cc”, which does not correspond to the targeted brand.

The domain is listed on a single security blocklist and is flagged by PhishDestroy, demonstrating that at least one anti‑phishing feed has identified it as malicious. AlienVault OTX includes the domain in one threat‑intelligence pulse, providing additional corroboration of its malicious nature. VirusTotal scans show nine of ninety‑three security vendors labeling the domain as malicious, further supporting the assessment. The domain explicitly impersonates the Kraken brand, as indicated in the intelligence brief, suggesting an attempt to lure Kraken customers or affiliates.

Concrete evidence beyond the listed indicators is not publicly available; the actual landing page content, credential‑harvesting mechanisms, or any associated malware have not been captured. Defenders should block DNS resolution for krab2web.xyz, add the domain to URL filtering policies, and monitor outbound connections to the Cloudflare IP 188.114.97.3 for any anomalous traffic. Continuous re‑evaluation is recommended, as the offline status may change and additional detection data could emerge.