krab4[.]biz

Analysis of the domain krab4.biz indicates a phishing infrastructure classified as elevated risk, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to IP address 172.67.155.46, hosted on Cloudflare's network (AS13335) in the United States, a common tactic to obscure origin and leverage CDN protections. Nameservers are set to drew.ns.cloudflare.com and tess.ns.cloudflare.com, further confirming Cloudflare usage. The domain's HTTP response returns a 403 Forbidden status, suggesting either deliberate access restrictions or a takedown action.

The page title 'Captcha' implies an attempt to mimic authentication or verification pages, though the exact content and target brand remain unconfirmed due to the domain's offline status. No SSL certificate is present, which is atypical for legitimate sites but consistent with hastily deployed phishing campaigns. The domain appears on one security blocklist (PhishDestroy) and is flagged by 2 of 95 security vendors on VirusTotal, indicating detection by at least two anti-phishing engines. Gridinsoft assigns a trust score of 0/100, reinforcing the domain's malicious classification.

While the domain is currently offline, defenders should monitor for reactivation or shifts in hosting. Network-level blocking of 172.67.155.46 and associated Cloudflare IPs may mitigate residual risk. Given the domain's short lifespan and lack of SSL, it is likely part of a disposable phishing kit rather than a long-term campaign. Further analysis is recommended if the domain resurfaces, particularly to identify any linked infrastructure or emerging patterns in registrar abuse.