krab8-at[.]com

This domain, krab8-at.com, is identified as a credential phishing site targeting users of the legitimate service krab8.at. Analysis indicates the page mimics the authentic krab8.at interface, likely designed to harvest login credentials, payment details, or other sensitive user data. No specific drainer kit or malware payload has been confirmed in this campaign, though the generic_phishing classification suggests broad targeting of personal or financial information. The domain does not exhibit overt ties to known phishing toolkits but relies on social engineering to deceive victims. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.94.67, a Cloudflare-hosted endpoint that obscures the true origin of the phishing infrastructure. Detection metrics show 7 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to phishing pages. No detections were recorded in Google Safe Browsing at the time of analysis, though this does not preclude prior or future flagging. As of the latest assessment, krab8-at.com has been taken offline, likely in response to abuse reports or automated takedown mechanisms. The domain remains registered, however, and could be reactivated or repurposed for further malicious activity. Users who accessed the site prior to its deactivation may still be at risk of credential compromise or follow-up attacks. Organizations are advised to monitor for unauthorized access attempts linked to this domain and implement phishing-resistant authentication methods. The elevated risk level persists due to the domain's registration status and the registrar's history of abuse.