krab-5-cc[.]net

This domain is flagged as a generic phishing site designed to redirect users through altered links, as indicated by its page title 'krab5.cc - измененная ссылка.' The threat level is classified as elevated due to confirmed malicious activity and active blocking by security systems. Analysis indicates this is not a crypto drainer or credential harvester but rather a redirect-based phishing attempt to mislead users into visiting fraudulent or compromised destinations. Infrastructure analysis reveals the following technical indicators: VirusTotal detection ratio of 8/95 security vendors, presence on 1 security blocklist, and association with the IP address 172.67.177.83. The domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently linked to suspicious domains. Additional indicators include a Gridinsoft trust score of 0/100, appearance in 1 AlienVault OTX threat intelligence pulse, and blocking by PhishDestroy. The SSL certificate is issued by Google Trust Services, which does not mitigate the domain's malicious intent. Mitigation steps for this specific threat type include blocking the domain and its resolving IP (172.67.177.83) at the network perimeter. Security teams should update endpoint protection rules to detect and prevent access to altered redirect links, particularly those mimicking legitimate domains like krab5.cc. Users should be educated on identifying unexpected URL modifications in links, especially those containing non-standard characters or subdomains. Monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED may help preempt future phishing campaigns.