krab20at[.]com

This domain, krab20at.com, is flagged as a credential harvesting phishing threat with an elevated risk level. Analysis indicates it was designed to mimic legitimate login portals to capture user credentials, likely targeting financial or corporate accounts given the infrastructure and detection patterns observed. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolved to IP address 104.21.32.10 and employed Cloudflare services, including Cloudflare Browser Insights and HTTP/3 protocol support. The SSL certificate was issued by Google Trust Services. Security vendor detections on VirusTotal reached 6 out of 95, while Gridinsoft assigned a trust score of 0 out of 100. The domain appeared on one security blocklist and was blocked by PhishDestroy before being taken offline. The page title consistently returned a 404 error, suggesting either a placeholder or a takedown response. Mitigation for this threat involves implementing DNS-based blocking of the domain and its associated IP address 104.21.32.10 across enterprise networks. Security teams should monitor for any attempts to re-register the domain or reuse its infrastructure components, particularly Cloudflare configurations. End-user education should emphasize verifying SSL certificate issuers and domain registration dates when accessing login portals. Organizations are advised to review logs for connections to 104.21.32.10 or domains registered through NiceNIC during the February 2026 timeframe, as these may indicate compromise or targeted phishing attempts.