krab3[.]app

Analysis as of July 24 2026 indicates that the domain krab3.app was registered on February 21 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers are chris.ns.cloudflare.com and dee.ns.cloudflare.com, pointing to Cloudflare’s network (AS13335). DNS resolution returns the IP address 172.67.175.83, which is hosted in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming that HTTPS connections are encrypted. Automated scans reveal the presence of Cloudflare’s edge services and HTTP/3 support.

The only visible page title returned by the server is “Captcha”, and no further content has been captured because the service is currently taken offline. Threat intelligence feeds have flagged the domain. VirusTotal reports that two of ninety‑three security vendors have marked the domain as malicious. It is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation platform. Gridinsoft assigns a trust score of zero out of one hundred, indicating a high likelihood of abuse.

The combination of a recent registration, low trust score, and detection by multiple independent sources suggests that the domain was used for credential harvesting or similar phishing operations, consistent with the generic phishing classification supplied. Uncertainty remains regarding the exact phishing kit, targeted brand, or victim geography, as no additional payload or page content has been harvested. Defenders should continue to block krab3.app at perimeter filters, update DNS sinkhole entries, and monitor for any resurgence of activity. Threat‑intel teams are advised to correlate any future sightings of the IP address 172.67.175.83 or the Cloudflare nameservers with this indicator, and to share any newly observed artifacts with relevant sharing communities.