krab11[.]app

Analysis of the domain krab11.app indicates that it was registered on February 21, 2026 through NiceNIC International Group Co., Limited and subsequently resolved to the IP address 188.114.96.3, which is hosted by Cloudflare (AS13335) in the United States. The site employed a Google Trust Services / WE1 SSL certificate, suggesting an attempt to convey legitimacy, yet the HTTP response returned a 403 status code and the page title was observed as "Captcha," providing limited functional insight. Security telemetry shows that the domain is listed on a single blocklist and has been actively flagged by the PhishDestroy service.

VirusTotal scans record that two of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent. Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, indicating a strong negative assessment. The infrastructure leverages Cloudflare’s DNS service, as evidenced by the nameservers darl.ns.cloudflare.com and eloise.ns.cloudflare.com, which is a common tactic for threat actors seeking to hide origin.

At the time of reporting (July 24, 2026) the domain status is offline, which may reflect takedown actions or a temporary suspension by the hosting provider. Defenders should continue to block the domain at network perimeter controls, include the associated IP address 188.114.96.3 in threat‑intel feeds, and monitor for any re‑registration attempts or related domains using the same registrar or hosting profile. Ongoing vigilance is advised, particularly for email or web traffic that references the "Captcha" page title, as it may be employed in future phishing campaigns targeting credential capture.