krab129[.]cc

This domain, krab129.cc, is under investigation for credential theft activity. Analysis indicates no direct association with a specific brand or drainer kit, but the infrastructure and page title (krab12.cc) suggest an attempt to deceive users into submitting sensitive login credentials. The domain exhibits characteristics typical of phishing campaigns, including the use of Cloudflare for obfuscation and a recently registered domain to evade detection. Technical indicators reveal the following: VirusTotal detections stand at 0/95, meaning no antivirus engines have flagged the domain at this time. The domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 188.114.97.3. It appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, and the domain employs Cloudflare Browser Insights and HTTP/3 for performance and anonymity. The Gridinsoft trust score is 0/100, further indicating high risk. As of the latest assessment, krab129.cc has been taken offline, likely due to enforcement actions by security providers. However, the domain remains a potential threat due to its recent registration and lack of widespread detection. Users who may have interacted with this domain are advised to monitor for unauthorized access to accounts, reset credentials for any services accessed during the exposure window, and verify the legitimacy of communications from similar domains. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.