secure-kraen-en-cdn[.]daftpage[.]com

secure-kraen-en-cdn.daftpage.com is a high-risk brand impersonation domain specifically designed to mimic the legitimate cryptocurrency exchange Kraken. Currently taken offline, this domain posed a significant threat to users attempting to access their Kraken accounts. The page title, "Sign In | Kraken.com," was a clear attempt to deceive visitors into entering their credentials, making this a credential theft operation masquerading as a trusted brand.

PhishDestroy’s analysis reveals that the domain was flagged by 13 of 95 VirusTotal security vendors and appears on one security blocklist. Registered through OVH, SAS on October 24, 2021, it resolves to IP address 216.150.16.129. The SSL certificate was issued by Let's Encrypt / R13, lending a false sense of legitimacy. Google Safe Browsing specifically flags this domain for phishing activity. The combination of brand impersonation, a convincing login page, and a relatively long registration period indicates a sophisticated and persistent threat.

Given its status as offline and the clear evidence of malicious intent, users should avoid any interaction with this domain. PhishDestroy recommends that individuals who may have visited the page change their Kraken account passwords immediately and enable two-factor authentication. Organizations should add this domain to their blocklists and educate users about verifying URLs before entering sensitive information. Continuous monitoring for similar domains using the unique seed 1425a4 is advised to prevent future attacks.