crunchcat[.]run

Analysis of the domain crunchcat.run indicates that it is actively being used for malicious phishing operations. The domain was registered through GoDaddy.com, LLC and created on July 20, 2026, suggesting a very recent launch. It is hosted on the IP address 2.24.198.130 and utilizes the authoritative name servers ns09.domaincontrol.com and ns10.domaincontrol.com, both of which are typical of GoDaddy’s DNS infrastructure. The domain is currently listed on three security blocklists, confirming that external threat‑intelligence feeds have flagged it as malicious.

Independent detection platforms have also taken action: PhishDestroy, MetaMask, and SEAL have each blocked the domain, providing corroborating evidence of its phishing intent. The domain’s status remains active, meaning it continues to resolve and potentially serve malicious content. While the exact phishing payload, page title, or targeted brand have not been disclosed in the available intelligence, the combination of recent registration, dedicated hosting, blocklist presence, and multiple vendor blocks establishes a high confidence that the domain is being used to harvest credentials or otherwise deceive users.

Defenders should add crunchcat.run to deny‑list configurations across network perimeter devices, DNS filters, and endpoint protection suites. Continuous monitoring of DNS queries for this domain and its associated IP address is advised, as is the application of strict outbound filtering rules to prevent any potential data exfiltration. Organizations should also inform users about the emerging threat and encourage verification of any unsolicited communications that reference the domain.