service-kraken-app[.]daftpage[.]com

This domain, service-kraken-app.daftpage.com, poses a high-risk brand impersonation threat specifically targeting Kraken, a well-known cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into entering their login credentials by presenting a fraudulent replica of Kraken’s official sign-in page, titled 'Sign in to Kraken - Kraken.' Such impersonation attacks are commonly used to harvest sensitive account details, which may subsequently be exploited for unauthorized access, financial theft, or further malicious activities such as crypto draining or account takeovers.

Infrastructure analysis reveals multiple concrete indicators of malicious intent. The domain was registered on October 24, 2021, through OVH, SAS, and currently resolves to the IP address 216.150.1.193, hosted on Amazon.com, Inc.’s AS16509 network. Security vendors on VirusTotal flagged the domain as malicious, with 13 out of 95 engines detecting it as a threat. Additionally, the domain appears on at least one security blocklist and was previously blocked by PhishDestroy. The SSL certificate, issued by Let’s Encrypt (R13), does not mitigate the risk, as fraudulent sites frequently use valid certificates to appear legitimate.

Users who visited service-kraken-app.daftpage.com or entered credentials on the site should take immediate action to secure their accounts. First, reset passwords for Kraken and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) if not already active. Monitor account activity for unauthorized transactions or logins, and report any suspicious behavior to the legitimate platform’s support team. Additionally, consider scanning the device used to access the site for malware or unauthorized software, as credential theft sites may deploy additional payloads.