crabfun[.]network

The domain crabfun.network was registered on 2026-04-04 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 104.21.71.11. The IP is hosted by Cloudflare, Inc. and is geolocated to Canada. DNS resolution uses the Cloudflare name servers hope.ns.cloudflare.com and etienne.ns.cloudflare.com, indicating that the domain leverages a widely used CDN service for traffic anonymization.

Infrastructure analysis shows the site presents an HTTP 403 status and serves a TLS certificate issued by Let’s Encrypt (certificate identifier E7). The Gridinsoft trust score is 0 out of 100, reflecting a lack of reputation. The page title returned by the server is "Just a moment…", which provides no functional content to assess the payload.

Threat intelligence reports classify crabfun.network as a generic phishing campaign. The domain appears on a single security blocklist and has been referenced in eight AlienVault OTX pulses. VirusTotal scans have resulted in two positive detections out of ninety‑five security vendors. The blocklist PhishDestroy also lists the domain as blocked. The overall risk rating is high and the operational status is marked as active.

While the observed data confirms the presence of phishing‑related indicators, the exact malicious payload and targeted victim profile remain unknown because the page content has not been publicly captured. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the associated IP and name servers, and consider adding the domain to internal threat intelligence feeds. Ongoing observation of any changes to the SSL certificate, HTTP response codes, or additional detections on VirusTotal is recommended to adjust mitigation measures promptly.