krab8c[.]cc

PhishDestroy identifies krab8c.cc as an active cryptocurrency drainer phishing domain operating under a generic naming scheme designed to impersonate legitimate services. This domain presents a classic fake login portal setup to harvest wallet credentials or inject malicious JavaScript for unauthorized crypto transfers. Security researchers tracking drainer kits reported similar patterns in mid-2025 campaigns targeting MetaMask and Trust Wallet users. This domain was flagged by PhishDestroy with an elevated risk classification, confirmed by 5/95 security vendors on VirusTotal. krab8c.cc resolves to IP 172.67.137.138 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on December 11, 2025. The domain operates with a Google Trust Services SSL certificate (GSB status: trusted) despite its malicious nature, adding a false layer of legitimacy. Current blocklist tracking shows consistent detection since creation. Currently active with consistent threat signals, this domain remains unblocked by several security layers due to its recent registration and SSL certification. PhishDestroy maintains active monitoring with response actions including domain takedown requests and IP de-listing procedures. Remaining risk is elevated due to the drainer's capability to bypass some security filters through SSL encryption and rapid domain rotation tactics. Users should verify any interaction with this domain through PhishDestroy's database before proceeding. Immediate blocking of IP 172.67.137.138 at firewall/security appliance level is recommended for organizational networks. This domain represents an ongoing threat until full remediation is achieved.