krab--13[.]cc

PhishDestroy has identified the domain krab--13.cc as a generic phishing threat, currently taken offline but previously active. This domain was designed to deceive users into providing sensitive information, likely through a fake login page. The site was created on March 26, 2026, and resolved to IP address 172.67.193.141, hosted behind Cloudflare infrastructure. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and used an SSL certificate issued by Google Trust Services (WE1). At the time of analysis, 8 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The page title was recorded as "krab13.cc," which matches the domain name and suggests an attempt to appear legitimate.

Further investigation reveals that the domain was likely part of a broader phishing campaign, though no specific brand was impersonated. The elevated risk level is supported by its relatively recent creation date and the multiple vendor flags. The domain's association with a known registrar and the use of a widely recognized SSL provider do not mitigate the risk, as these can be easily obtained for malicious purposes. The fact that the domain has been taken offline is a positive development, but users should remain vigilant as similar domains may appear.

Given this intelligence, users are strongly advised to avoid any interaction with krab--13.cc or similar domains. PhishDestroy recommends verifying all URLs through its platform before entering personal information, especially when prompted by unsolicited communications. If you have already entered credentials on this site, change your passwords immediately and enable multi-factor authentication on affected accounts. Organizations should block this domain and its IP address (172.67.193.141) at the network level to prevent access. Continuous monitoring for related domains and updated blocklists is essential to maintain security.