krab15[.]org

krab15.org entered the PhishDestroy evidence set on Jun 15, 2026. The assembled evidence scores 81/100 (high).

Two independent sources are positive: VirusTotal and Spamhaus DBL. VirusTotal recorded 3 detections among 91 engines: Forcepoint ThreatSeeker, Fortinet, Gridinsoft on Jul 18, 2026 at 18:45 UTC. Spamhaus DBL: DBL_PHISH on Jul 13, 2026 at 14:34 UTC. The evidence is not unanimous. On Jul 25, 2026 at 01:30 UTC, AlienVault OTX listed 16 community pulse references (not vendor detections); Google Safe Browsing returned no flag. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC.

HTTP 301 was recorded on Aug 7, 2026 at 18:45 UTC. Latest classified outcome: redirect observed; cause http redirect on Aug 7, 2026 at 00:50 UTC. Registration records for the domain list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar and May 27, 2026 as the creation date. Registration preceded first observation by 18 days. At collection time, the hostname resolved to 188.114.97.3 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. TLS metadata lists Let's Encrypt / YE1 as the certificate issuer with validity through Sep 17, 2026; checked Jul 27, 2026 at 07:02 UTC.

Neither a page title nor a landing-page capture is stored. No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as phishing. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.