krab4[.]run

Analysis of the domain krab4.run indicates it is associated with phishing activity, currently offline as of July 25, 2026. The domain was registered on January 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 104.21.25.149, hosted on Cloudflare's infrastructure (AS13335) in the United States. The SSL certificate is classified as WE1, a low-trust category often observed in malicious or misconfigured sites. The page title, 'krab1.at,' suggests a possible connection to another domain, though the exact nature of the phishing campaign remains unconfirmed due to the site's offline status.

Security vendor detection is limited, with only 2 of 93 engines on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its suspicious classification.

No specific brand impersonation or phishing kit has been identified in the available data, and the content of the site has not been analyzed. Defenders should treat this domain as part of phishing infrastructure, particularly given its recent registration, use of Cloudflare for hosting, and low-trust SSL certificate. Monitoring for reactivation or related domains (e.g., krab1.at) is recommended, along with blocking the resolved IP and domain across security controls.