portal-krake-en-us[.]daftpage[.]com

This domain, portal-krake-en-us.daftpage.com, is identified as a brand impersonation threat specifically targeting Kraken, a well-known cryptocurrency exchange platform. The domain is designed to deceive users into believing they are interacting with the legitimate Kraken service, potentially leading to credential theft, unauthorized transactions, or malware distribution. Analysis confirms the domain is currently offline, though its prior activity and infrastructure warrant continued scrutiny. Infrastructure analysis reveals the domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.16.193, hosted on Amazon.com, Inc. (AS16509) infrastructure. The domain appears on one security blocklist and is flagged by 18 of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and fraudulent sites, and the page title, 'Kraken: Buy and sell crypto securely,' directly mimics the branding of the targeted exchange. The domain's creation date suggests it may have been operational for an extended period, increasing the likelihood of user exposure. Given the elevated risk level and historical activity, this domain should be treated as a confirmed threat vector. Organizations and users are advised to block all connections to portal-krake-en-us.daftpage.com at the network level, including DNS and IP-based restrictions. Security teams should monitor for any resurgence of the domain or associated infrastructure, particularly under similar naming conventions or hosting providers. End-users who may have interacted with the domain should immediately reset credentials, enable multi-factor authentication, and review transaction histories for unauthorized activity. Proactive threat hunting for related indicators of compromise is recommended to mitigate potential downstream risks.