krakenapp[.]web[.]app

On July 25, 2026, the domain krakenapp.web.app was identified as a high‑risk brand‑impersonation site targeting Kraken. The site is currently offline, returning HTTP 404, and its DNS resolution points to 199.36.158.100, an address owned by Fastly, Inc. (AS54113) located in the United States. The hosting infrastructure utilizes Firebase and enforces HSTS with HTTP/3 support, consistent with typical Google‑hosted services. The TLS certificate is issued by Google Trust Services under the WR4 profile, confirming the use of Google’s certificate authority. Registration information shows the domain was provisioned through Google LLC, and the nameserver lookup failed (NS_NOT_FOUND), which may indicate a misconfiguration or deliberate concealment.

Content analysis reveals the page title "Crypto Futures Trading for Institutions | Kraken Futures", which directly references the legitimate Kraken brand. Google Safe Browsing has classified the URL as social engineering, and 11 of 95 VirusTotal scanners flagged the domain, indicating a moderate consensus of malicious behavior. The domain appears on a single security blocklist and has been blocked by the PhishDestroy feed, reinforcing its reputation as a phishing or crypto‑scam vector. The listed scam type is "Crypto Scam", and the site explicitly impersonates Kraken.

While the site’s exact payload (e.g., credential‑stealing forms) has not been observed, the combination of brand‑specific page title, social‑engineering warning, and multiple vendor detections suggests an intent to deceive Kraken users, likely to harvest login credentials or lure victims into fraudulent cryptocurrency transactions. Defenders should add the domain to blocklists at the network perimeter and endpoint detection layers, monitor DNS queries for the 199.36.158.100 address, and enforce URL filtering against the identified page title.