krab-15-cc[.]com

Analysis of the domain krab-15-cc.com reveals infrastructure consistent with an active credential phishing campaign impersonating the legitimate service krab15.cc. The domain was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in phishing operations. It currently resolves to the IP address 188.114.96.3, which is geolocated to Canada and associated with CloudFlare, Inc. The use of Cloudflare nameservers (casey.ns.cloudflare.com and sonia.ns.cloudflare.com) is a common tactic to obfuscate hosting origins and enhance operational resilience against takedowns. The domain presents a 301 HTTP redirect, likely funneling victims toward a fraudulent login portal designed to harvest credentials. Its SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy, though such certificates are routinely exploited in phishing campaigns. Detection metrics indicate moderate but growing awareness: three out of ninety-five security vendors on VirusTotal have flagged the domain, while a single threat intelligence pulse in AlienVault OTX and one security blocklist entry (PhishDestroy) further corroborate its malicious classification. The Gridinsoft trust score of 0/100 underscores the domain’s high-risk profile. Infrastructure analysis reveals no direct ties to known phishing kits or threat actor groups, though the impersonation of krab15.cc suggests a targeted approach. The domain’s creation date aligns with recent phishing trends, where newly registered domains are weaponized within weeks of activation. Defenders should prioritize blocking resolutions to 188.114.96.3 and monitoring for additional domains registered under the same registrar, particularly those mimicking regional or niche service providers. Given the domain’s active status and low detection rate, network-level protections and endpoint filtering are recommended to mitigate exposure.