785rpm-gacoorabiskeman[.]crabdance[.]com

This domain, 785rpm-gacoorabiskeman.crabdance.com, is identified as a credential theft phishing operation designed to harvest user login credentials through fraudulent authentication interfaces. Analysis indicates the absence of direct brand impersonation or cryptocurrency drainer components, suggesting a broader, non-targeted approach to credential collection. The infrastructure exhibits characteristics typical of low-sophistication phishing campaigns, including the use of free subdomain services and generic page titles such as 'Checking...' to evade initial detection mechanisms. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 3.101.154.201, hosted on infrastructure belonging to a major cloud provider within the United States under autonomous system AS16509. The domain was registered through eNom, LLC, with a creation date of February 21, 2026, indicating either a typographical error in records or potential domain pre-registration for malicious use. Security vendor assessments on VirusTotal flag the domain as malicious, with 12 out of 95 engines detecting it. The domain appears on two independent security blocklists, including entries from PhishDestroy and PhishingDB. The SSL certificate is issued under the identifier 'PhishDestroy / botadmin.destroy.tools,' further corroborating its association with known phishing toolkits. Current status indicates the domain has been taken offline, likely as a result of automated takedown procedures or manual intervention by hosting providers. Despite its offline state, residual risk persists due to the potential for rapid redeployment of similar infrastructure under different subdomains or top-level domains. Organizations and end-users are advised to implement proactive measures, including the integration of the identified IP address and domain into network-level blocking systems, as well as the deployment of endpoint protection solutions capable of detecting credential theft attempts. Continuous monitoring of subdomain generation patterns associated with the crabdance.com service is recommended to preemptively identify and mitigate future iterations of this campaign.