krab45[.]shop

Analysis as of July 25, 2026 indicates that the domain krab45.shop is actively serving a generic phishing payload. The domain resolves to the IP address 172.67.172.37, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. The registration was performed through Nicenic International Group Co., Limited, and the domain is protected by a Let’s Encrypt TLS certificate. DNS resolution is delegated to the Cloudflare nameservers elijah.ns.cloudflare.com and novalee.ns.cloudflare.com, confirming the use of Cloudflare’s edge network. HTTP requests receive a 301 redirect response, and the site advertises Cloudflare Browser Insights, Cloudflare, and HTTP/3 as underlying technologies.

Reputation services show a poor trust profile: Gridinsoft assigns a score of 0 out of 100, and the domain appears on a single external blocklist. VirusTotal analysis reports that three of ninety‑four scanning engines flagged the domain, reinforcing the suspicion of malicious activity. PhishDestroy has also listed krab45.shop as blocked, indicating that at least one dedicated anti‑phishing service considers the domain abusive. The page title returned by the web server is simply “krab45.shop”, providing no additional context about the targeted brand or the specific content hosted. No further content analysis is available, so the exact phishing technique, credential‑capture pages, or victim‑targeting vectors remain unknown.

Given the observed infrastructure, defenders should treat krab45.shop as high‑risk. Recommended actions include adding the domain to network‑level deny lists, updating DNS filtering policies to block the IP 172.67.172.37 and its associated CIDR ranges, and monitoring for any outbound connections to the Cloudflare edge. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection status. Organizations employing web‑proxy or secure web‑gateway solutions should enforce URL filtering for this domain.