krab5a[.]cc

Analysis indicates that the domain krab5a.cc is actively serving as a phishing endpoint, as evidenced by its inclusion on at least one security blocklist and detection by four of ninety-three security vendors on VirusTotal. The domain was registered on February 21, 2026, through Cloudflare, Inc., and currently resolves to the IP address 89.110.99.61, which is geolocated in Russia and associated with AS48282 (Hosting Technology LTD). Infrastructure analysis reveals the use of Cloudflare nameservers (arturo.ns.cloudflare.com and cass.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), suggesting an attempt to appear legitimate while masking the true hosting origin. The domain returns an HTTP 302 redirect status, which is commonly employed in phishing campaigns to obscure the final malicious destination.

The observed page title, 'Privacy error,' may indicate a misconfigured or intentionally deceptive landing page designed to exploit browser security warnings. GridinSoft assigns a trust score of 0/100, further corroborating its classification as high-risk. While the specific phishing kit or targeted brand remains unconfirmed, the combination of technical indicators—including the hosting provider, SSL certificate, and detection by security vendors—supports its designation as an active threat.

Defenders are advised to block the domain at the network level, particularly given its resolution to a known malicious IP. Monitoring for related domains registered under the same Cloudflare account or resolving to the same ASN may help identify additional campaign infrastructure. Given the domain's recent creation and continued activity, organizations should treat it as a priority for containment and review any recent user interactions that may have involved this endpoint.