krab21cc[.]net

krab21cc.net is currently flagged as an active credential‑phishing site. The domain was registered on 9 May 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare’s network, resolving to 172.67.164.203 in Canada. DNS resolution is provided by roxy.ns.cloudflare.com and yevgen.ns.cloudflare.com. The site presents a page titled “Captcha” and responds with an HTTP 301 redirect, indicating a possible attempt to forward visitors to a credential‑collection endpoint. The SSL certificate is issued by Google Trust Services (WE1), showing the use of a legitimate certificate authority. Reputation scoring is poor, with Gridinsoft assigning a trust score of 0 / 100, and the domain appears on a single security blocklist. It has been referenced in one AlienVault OTX pulse and was blocked by the PhishDestroy feed. No additional page content or payload details have been publicly disclosed, so the exact phishing vector and target audience remain unknown. Defenders should add the domain to block lists, monitor DNS queries for the associated IP range, and enforce email filtering rules that flag URLs pointing to recently created Cloudflare‑hosted domains. Continued observation is recommended to capture any changes in page content or new indicators of compromise.