krab6[.]ink

This domain, krab6.ink, is flagged as a generic phishing site designed to mimic legitimate login portals, specifically impersonating the domain krab5.cc as evidenced by the page title. Analysis indicates no direct association with known cryptocurrency drainer kits or brand-specific impersonation campaigns; however, the use of a deceptive page title suggests an intent to harvest user credentials through fraudulent login interfaces. The infrastructure lacks overt branding, relying instead on generic phishing tactics to deceive targets into submitting sensitive information. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.46.60, hosted on Cloudflare’s network (AS13335) in the United States. VirusTotal reports 9 detections out of 95 security vendors, while the domain appears on a single security blocklist. Registration details show the domain was created on February 21, 2026, through registrar NiceNIC International Group Co., Limited. No SSL certificate is present, and the domain is currently blocked by at least one security filter. The creation date suggests either a typo or an attempt to pre-register domains for future malicious use, though the latter is less likely given the immediate phishing activity. As of the latest assessment, krab6.ink has been taken offline, reducing immediate exposure risk. However, the domain’s infrastructure—hosted on a widely used content delivery network and registered through a low-friction registrar—remains conducive to rapid redeployment. The absence of SSL further increases the likelihood of detection by security mechanisms but does not mitigate the underlying threat. Organizations and individuals are advised to monitor for re-registration or similar domains (e.g., krab[0-9].cc/ink) and implement DNS-based blocking for the observed IP (104.21.46.60) as a precautionary measure. The elevated risk level persists due to the domain’s confirmed phishing history and potential for reuse.