secure-kraken-divaceio[.]daftpage[.]com

This domain is flagged for elevated-risk brand impersonation targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into disclosing login credentials by mimicking the official Kraken authentication portal, as evidenced by the page title 'Kraken: Login® | Log In To Your Account®.' Infrastructure analysis reveals the domain secure-kraken-divaceio.daftpage.com was registered on October 24, 2021, through OVH, SAS. It resolves to the IP address 216.150.16.65, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain appears on one security blocklist, and 12 out of 95 security vendors on VirusTotal have flagged it as malicious. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and fraudulent sites. The domain has since been taken offline, though historical data confirms its use in credential harvesting operations. Mitigation for this specific threat type involves implementing strict domain monitoring for lookalike or typosquatted variations of Kraken’s official domains. Organizations should enforce multi-factor authentication (MFA) for all user accounts to reduce the impact of credential theft. End users should verify domain authenticity by cross-referencing URLs with official sources before entering sensitive information. Security teams are advised to block the domain and associated IP (216.150.16.65) at the network perimeter and update detection rules to identify similar impersonation attempts targeting cryptocurrency platforms.