krab124[.]cc

This domain, krab124.cc, has been identified as a generic phishing threat targeting users through impersonation of the Krab12 platform. Currently, the domain is offline, though prior analysis indicates it was actively serving phishing content. The threat type is classified as generic phishing, with no specific brand confirmation beyond the resemblance to Krab12 in its page title and naming convention. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. It resolves to the IP address 172.67.157.93, which is associated with Cloudflare services, including Cloudflare Browser Insights and HTTP/3 protocol support. Detection metrics show zero flags from 95 VirusTotal vendors, though it appears on one security blocklist. The domain holds a Gridinsoft trust score of 0 out of 100, and its SSL certificate is issued by Google Trust Services. The page title observed during active periods was 'krab12.cc,' further suggesting an intent to mimic legitimate services. At present, krab124.cc is offline, but its infrastructure and registration details warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP address (172.67.157.93) at the network level. Security teams should update detection rules to include this domain in phishing filters and monitor for any re-emergence or similar domains registered through the same registrar. Users who may have interacted with the domain should verify account integrity and reset credentials as a precautionary measure.