kraken-login-auth-sso[.]typedream[.]app

Analysis dated July 23, 2026 identifies the domain kraken-login-auth-sso.typedream.app as an active brand‑impersonation infrastructure targeting users of the cryptocurrency exchange Kraken. The site presents the page title “Kraken Login: | Access Your Secure Crypto Dashboard,” which directly references the targeted brand and aligns with the listed scam type “Crypto Scam.” VirusTotal records show that 14 of 95 security vendors have flagged the domain, indicating moderate detection across multiple scanning engines. The domain is hosted behind Cloudflare, Inc., with the authoritative registrar also listed as Cloudflare, Inc. DNS resolution points to the IPv4 address 104.21.37.85, an address owned by AS13335 Cloudflare, Inc., located in the United States. The SSL certificate is issued by Google Trust Services under the “WE1” identifier, providing a valid HTTPS chain but offering no assurance of legitimacy.

HTTP probing returned a 404 status code, suggesting that the malicious landing page may no longer be reachable, consistent with the reported offline status. Infrastructure fingerprints include Node.js, React, Next.js, and various Google Cloud services such as Cloud Trace and Cloud CDN, all of which are common components in modern phishing kits. The domain appears on a single blocklist, PhishDestroy, and has been recorded as blocked by that service. No nameserver information is available in the current dataset.

Defenders should update URL filtering rules to block the exact domain and monitor for any resurgence of the associated IP address or similar sub‑domains employing the same technology stack. Continuous observation of Cloudflare‑hosted assets tied to the 104.21.37.85 address is recommended, as threat actors frequently recycle infrastructure.