kast-app[.]app

This domain, kast-app.app, was registered on 12 March 2026 through NiceNIC International Group Co., Limited and resolves to 188.114.96.3, an address owned by Cloudflare (AS13335) in the United States. The site presented a page title of “KAST Login – The global money app powered by stablecoins,” indicating an attempt to harvest credentials for a stable‑coin‑related financial service. The TLS certificate is issued by Let’s Encrypt (E7) and the site employed common front‑end libraries such as jQuery, OWL Carousel, and jsDelivr, as well as Cloudflare features including HSTS, Browser Insights, and HTTP/3. HTTP responses return a 403 status code, and the domain is currently taken offline. Threat intelligence shows the domain appears on four public blocklists and has been flagged by four dedicated anti‑phishing services (PhishDestroy, MetaMask, ScamSniffer, SEAL).

VirusTotal analysis recorded detections by ten of ninety‑four scanning engines, reinforcing the malicious classification. The combination of a credential‑phishing lure, rapid registration, and use of reputable hosting infrastructure is consistent with a high‑risk phishing campaign targeting users of cryptocurrency or stable‑coin applications. Uncertainty remains regarding the exact payload delivered to victims, as the site is no longer reachable and no malware hashes have been published. No additional infrastructure such as command‑and‑control servers or secondary domains have been observed beyond the Cloudflare front‑end.

Defenders should immediately block kast-app.app at network perimeter and update endpoint allowlists to reject any connections to the associated IP address. Monitoring of new domains that resolve to the same Cloudflare IP range and that reference “KAST” or stable‑coin terminology is recommended.