begin-krakken-cdn[.]typedream[.]app

The domain begin-krakken-cdn.typedream.app was observed resolving to the IPv4 address 188.114.96.3, which is hosted within Cloudflare’s AS13335 network in the United States. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 trust anchor, indicating a legitimate‑looking HTTPS endpoint. HTTP requests to the site return a 403 Forbidden status, and DNS queries for authoritative name servers return NS_NOT_FOUND, suggesting either misconfiguration or intentional concealment of the authoritative NS records. The infrastructure stack identified by passive fingerprinting includes Node.js, React, Next.js, Google Cloud services (including Cloud Trace and Cloud CDN), Cloudflare edge protection, and Webpack bundling, a combination commonly seen in modern web applications but also leveraged by malicious actors to mimic legitimate services.

VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain, providing independent corroboration of malicious intent. The domain is currently listed on a single public blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing the consensus that it is being used for phishing. No page title or brand targeting information is available, and the site has been taken offline as of the report date, limiting immediate exposure but leaving the underlying infrastructure reusable for future campaigns.

Defenders should continue to enforce network‑level denial of any traffic to 188.114.96.3, especially from internal users, and add the fully qualified domain name to local DNS blocklists. Monitoring for re‑registration of the domain or reuse of the associated Cloudflare account is advisable, as threat actors often recycle compromised hosting assets. Logging of TLS handshake attempts can help identify any residual client connections attempting to reach the site before the offline status is fully propagated.