krab2cc[.]ltd

This domain, krab2cc.ltd, was registered on 2025-12-10 through NiceNIC International Group Co., Limited and is hosted on the IPv4 address 104.244.79.9, which belongs to AS53667 FranTech Solutions in Switzerland. The domain resolves via the Cloudflare authoritative nameservers nick.ns.cloudflare.com and paislee.ns.cloudflare.com. No TLS certificate is presented, indicating that the site is served only over HTTP. The page title returned by the server is the Russian phrase “Один момент…”, and the site is currently taken offline.

Threat intelligence indicates that krab2cc.ltd appears on one security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that two of ninety‑three security vendors flagged the domain, confirming a low‑level detection signal. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The available data do not reveal the specific brand or service being impersonated, and no additional content analysis has been performed beyond the title.

Consequently, the precise phishing lure remains uncertain. Defenders should add the resolved IP address and the domain name to blocklists, enforce DNS sink‑holing, and monitor for any re‑activation. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in detection status or content. The combination of blocklist presence, low trust score, absence of TLS, and vendor flags supports an elevated risk rating for this infrastructure.