krab1[.]shop

The domain krab1.shop was observed as offline on 24 July 2026. Registration records show it was created on 9 December 2025 via NiceNIC International Group Co., Limited. DNS resolution points to the IP address 172.67.154.117, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The authoritative name servers are aspen.ns.cloudflare.com and david.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services.

No TLS certificate was presented when the site was queried, and the HTTP response returned a page with the title “Captcha”, suggesting the site may have been designed to lure users into solving a captcha as part of a credential‑harvesting flow. Threat intelligence shows that four of ninety‑three VirusTotal scanners flagged the domain, and the site appears on a single public blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigns it a trust score of 0 out of 100, reflecting a high confidence of malicious intent. The limited detection footprint—only one blocklist entry and a small number of vendor detections—means that broader visibility may be lacking, and additional monitoring is advisable.

Defenders should continue to block the domain at network perimeter and DNS layers, given its association with phishing‑related activity. Because the site is hosted behind Cloudflare, any future re‑hosting could inherit the same IP range, so IP‑based allowlists should be avoided. Researchers are encouraged to submit the URL to additional sandbox services to enrich detection statistics, and to monitor the registrar NiceNIC for further registrations that may reuse the same infrastructure. Until more detailed payload or phishing‑kit evidence is released, the primary mitigation remains domain‑level denial and continued threat‑intel sharing.