pb-coach[.]crabdance[.]com

The domain pb-coach.crabdance.com was registered on June 08, 2026. Within days it appeared on three public security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal analysis shows that eight of ninety‑one scanning engines flagged the domain as malicious, indicating a consensus of concern among multiple vendors. DNS resolution points to the loopback address 127.0.0.2, which is atypical for legitimate web hosting and suggests a deliberate attempt to avoid exposure of a real backend server.

No SSL certificate information, HTTP response codes, or page title data are currently available, limiting the ability to confirm the content served by the site. The lack of publicly disclosed registrar details, ASN, or geographic hosting data further obscures the infrastructure footprint. Defenders encountering traffic to pb‑coach.crabdance.com should treat the connection as high‑confidence malicious, block the domain at perimeter firewalls, DNS resolvers, and endpoint web filters, and incorporate the indicator into intrusion detection signatures.

Continuous monitoring of threat‑intel feeds for additional detections, updates to the blocklist status, and correlation with internal logs for any attempted credential submission to the domain are recommended. Because the site resolves to a loopback address, any attempted connections will fail, but the presence of the domain in phishing‑specific blocklists suggests it may be used as a lure in emails or other social‑engineering vectors. Organizations should educate users about the suspicious nature of unsolicited communications referencing “pb‑coach” or related terms and enforce multi‑factor authentication to mitigate credential theft risk.