krab18at[.]cc

PhishDestroy identifies krab18at.cc as an active crypto drainer phishing site designed to steal cryptocurrency from unsuspecting users. The domain mimics legitimate crypto platforms to trick victims into connecting their wallets. Security analysts tracked this campaign via seed hash 376b60, confirming malicious intent through behavioral analysis and signature matching. This domain is not a generic phishing attempt but a targeted crypto drainer with a live drainer kit embedded in its frontend. The kit automatically drains user funds upon wallet connection, leveraging deceptive UI and fake transaction confirmations to obscure theft.

This domain was flagged by 8 out of 95 VirusTotal security vendors, indicating elevated recognition within the threat intelligence community. krab18at.cc resolves to IP address 188.114.96.3, a cloud-hosted infrastructure linked to multiple crypto scams. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on December 11, 2025, this domain is less than one month old, suggesting a fresh attack surface. Notably, it holds a valid SSL certificate issued by Google Trust Services (GTS), which may be abused to enhance credibility and bypass browser warnings. The domain remains active and continues to propagate across social media and crypto forums.

Despite takedown efforts from hosting providers and domain registrars, krab18at.cc remains operational, demonstrating resilience against reactive mitigation. Security teams have observed persistent redirection chains and cloaking mechanisms designed to evade automated scanners. Immediate action is required: users should block the domain at the network level, revoke any wallet connections made to this site, and report the domain to threat intelligence platforms. Remaining risk is elevated due to the domain’s recent registration, trusted SSL certificate, and active drainer payload. Without proactive blocking, this site will continue to compromise crypto users globally.