krabs6[.]net

The domain krabs6.net is associated with a credential theft phishing campaign. The domain does not impersonate any specific brand but is designed to trick users into revealing sensitive information such as usernames and passwords. The phishing kit used on this domain is not specified, but the domain's infrastructure and threat indicators suggest it was part of a broader phishing operation targeting multiple users.

Infrastructure analysis reveals that krabs6.net has a VirusTotal score of 6/95, indicating that six out of ninety-five security vendors have flagged this domain as malicious. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 104.21.12.225. It was created on March 27, 2026. The domain is currently not present on Google Safe Browsing (GSB) lists but appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, which is a common choice for both legitimate and malicious domains due to its ease of use and cost-effectiveness.

As of the latest assessment, krabs6.net is offline, which suggests that the domain has been taken down or is no longer active. Despite this, the domain remains a threat due to its history of malicious activity and the elevated risk level. Response actions should include monitoring for any reactivation of the domain and ensuring that any potentially compromised credentials are changed immediately. The remaining risk is moderate, as the domain could be reused in future phishing campaigns.