krab-10cc[.]com

Analysis of the domain krab-10cc.com indicates active phishing infrastructure targeting users of the Krab10 platform, as evidenced by the page title 'krab10.cc - Новая Рабочая Ссылка'. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 104.21.91.251. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which may complicate traditional detection and takedown efforts. The domain is flagged by 6 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and BLP-Malware. Additionally, it has been documented in 22 threat intelligence pulses on AlienVault OTX, suggesting broader recognition within the security community. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. However, the Gridinsoft trust score of 0/100 further corroborates the malicious classification. While the exact content and mechanics of the phishing operation remain unconfirmed due to the absence of direct page analysis, the domain's association with a known platform (Krab10) and its active status warrant immediate defensive action. Defenders should prioritize blocking the domain and its resolving IP at the network level, monitoring for related indicators of compromise, and alerting users to the potential threat. Given the domain's persistence and the use of Cloudflare, takedown efforts may require coordination with the hosting provider and registrar.