crab4[.]at

On 24 July 2026, analysis of the domain crab4.at identified infrastructure consistent with a Cloudflare brand‑impersonation campaign. The domain resolves to the IP address 104.21.59.192, which is owned by AS13335 Cloudflare, Inc. and geographically located in the United States. DNS resolution is performed by the authoritative nameservers ethan.ns.cloudflare.com and lily.ns.cloudflare.com, both of which are legitimate Cloudflare name servers, indicating that the operator leveraged a valid Cloudflare DNS configuration to host the malicious site. The TLS certificate presented by the site is issued by Google Trust Services / WE1 rather than by Cloudflare, a mismatch that further evidences the fraudulent nature of the service. An HTTP request to the root URL returns a 403 status code, and the page title returned is “Attention Required!

| Cloudflare”, matching the declared brand target. The domain was created on 6 March 2026 through the registrar 101Domain GRS Ltd., and it has since been taken offline. Reputation data show that crab4.at is listed on three independent blocklists – PhishDestroy, MetaMask, and SEAL – and a Gridinsoft trust score of 22 out of 100, reflecting a low confidence rating. VirusTotal scans have recorded seven positive detections out of ninety‑four security engines, reinforcing the malicious classification.

The combined evidence of brand‑specific page title, mismatched SSL, low trust score, blocklist listings, and multiple vendor detections supports the conclusion that crab4.at was used to impersonate Cloudflare services, likely to lure victims into a credential‑harvesting flow. Because the site is currently offline, immediate mitigation consists of adding the domain to local and network‑level blocklists, monitoring the associated IP address for any re‑use, and reviewing any outbound traffic that attempted to contact the domain prior to takedown.