krab6[.]art

Analysis of the domain krab6.art shows a newly registered Internet resource that is currently active and exhibits several indicators of compromise. The domain was created on February 23, 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.75.186, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The HTTP response is a 301 redirect and the site presents the page title "Just a moment..."; no TLS certificate is presented, indicating that the site is served over plain HTTP. Nameserver records point to hold1.suspendedaccount.com and hold2.suspendedaccount.com, a pattern often associated with domains that have been placed on hold or are in the process of being suspended, suggesting a low‑cost or disposable hosting arrangement.

The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment that it is being used for phishing. VirusTotal scans show that 2 out of 93 security vendors have flagged the domain, providing independent confirmation of malicious activity. No further details about the payload, targeted brand, or phishing kit are available from the current intelligence set.

Uncertainty remains regarding the specific content delivered to victims, the exact phishing workflow, and whether any credential‑stealing forms are hosted behind the redirect. Defenders should treat krab6.art as a high‑risk indicator and proactively block the domain and its associated IP at perimeter firewalls, DNS filtering solutions, and endpoint protection tools. Continuous monitoring of the IP address and its Cloudflare edge nodes is advised, as the infrastructure could be repurposed for additional malicious sites. Adding the domain to internal blocklists, sharing the indicator with threat‑sharing communities, and reviewing any outbound connections from internal hosts to the IP will help mitigate potential compromise.