krab--21[.]cc

The domain krab--21.cc was registered on March 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently flagged as high‑risk. Analysis shows the site is still active and returns an HTTP 301 redirect, indicating that visitors are being forwarded to another location. The sole page title observed is "Captcha," a common tactic used to delay automated analysis while presenting a legitimate‑looking login prompt.

Infrastructure data reveal that krab--21.cc resolves to the IP address 188.114.96.3, which is hosted by CloudFlare, Inc. in Canada. The domain uses the CloudFlare nameservers roxy.ns.cloudflare.com and yevgen.ns.cloudflare.com, and presents an SSL certificate issued by Google Trust Services under the WE1 designation. These characteristics are consistent with a fast‑flux or CDN‑based hosting model that obscures the true origin of the malicious payload.

Threat intelligence sources corroborate the malicious intent. VirusTotal reports that 6 of 95 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. AlienVault OTX lists the domain in eight separate threat pulses, and it appears on one public security blocklist. The domain has also been blocked by the PhishDestroy community, further confirming its use in phishing campaigns. The combination of low trust scores, multiple vendor detections, and repeated appearances in threat feeds underscores a coordinated phishing operation.

Defenders should immediately add krab--21.cc to outbound web filters and block it at the DNS layer. Continuous monitoring of the associated IP address and CloudFlare nameservers is advised, as the infrastructure may be reused for additional malicious domains. Organizations should also enforce multi‑factor authentication and educate users about unexpected captcha prompts that request credential entry, as such lures are typical of the observed phishing technique.