krab10cc[.]net

The domain krab10cc.net has been confirmed as a credential theft phishing site targeting users of the legitimate platform krab10.cc. Analysis indicates the infrastructure was designed to impersonate login pages, tricking victims into submitting sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The domain is currently offline, but its prior activity and technical indicators suggest a deliberate campaign to harvest and exfiltrate stolen data. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on December 11, 2025, and resolved to the IP address 104.21.2.126. Security vendors flagged the domain as malicious, with 14 out of 95 VirusTotal engines detecting it as a threat. The domain appears on at least one security blocklist, and its Gridinsoft trust score is 0/100, indicating high confidence in its malicious nature. The site employed Cloudflare and Cloudflare Browser Insights, likely to obfuscate its true hosting origin and evade detection. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy to phishing pages. At present, krab10cc.net is offline, though the infrastructure may be reactivated or repurposed for future campaigns. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for indicators of compromise, including login attempts from the IP 104.21.2.126 or domains with similar naming conventions. End-users who may have interacted with the site should reset credentials immediately, enable multi-factor authentication where available, and review accounts for unauthorized activity. Proactive threat hunting for related domains registered through NiceNIC or resolving to the same IP range is recommended to mitigate further risk.