krab17at[.]cc

The domain krab17at.cc was registered on March 28, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the Cloudflare‑hosted address 188.114.96.3, located in Canada. The site presents an HTTP 301 redirect and serves a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint. Infrastructure analysis shows the domain is served by Cloudflare, with detected technologies including Cloudflare Browser Insights and HTTP/3, and uses the nameservers roxy.ns.cloudflare.com and yevgen.ns.cloudflare.com. Reputation data indicate a Gridinsoft trust score of 0 / 100 and a detection rate of 7 out of 94 security vendors on VirusTotal, suggesting that multiple scanners have flagged the site as malicious. The domain appears on one public blocklist and is actively blocked by PhishDestroy. The page title returned is "KrakeN", and the site is classified as a brand‑impersonation campaign targeting the cryptocurrency exchange Kraken. The threat is currently active and assigned a high risk rating. While the exact content of the landing page has not been publicly disclosed, the combination of a brand‑specific title, low trust score, multiple vendor detections, and active blocklist listings provides strong evidence of a phishing operation. Defenders should consider adding krab17at.cc to network and endpoint blocklists, monitoring DNS queries for the associated IP address, and enforcing TLS inspection to detect any attempted credential harvesting. Continuous observation of the domain’s activity and rapid response to any new indicators are recommended to mitigate potential impact on Kraken users.