id-kraken[.]daftpage[.]com

This domain, id-kraken.daftpage.com, is flagged as an active brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain presents itself as a legitimate Kraken account access portal, with the page title explicitly stating 'Account access request - Kraken | Buy, Sell and Margin Trade,' which aligns with the known brand target. The domain was registered on October 24, 2021, and remains operational as of July 12, 2026, resolving to the IP address 216.150.1.193. It is currently listed on one security blocklist and has been flagged by 11 out of 95 security vendors on VirusTotal, confirming its malicious classification. Infrastructure analysis reveals the use of modern web technologies, including Node.js, React, Next.js, and Vercel, which are commonly employed in both legitimate and malicious web applications. The presence of HSTS and a Let's Encrypt SSL certificate suggests an attempt to appear secure and trustworthy, while additional services like Google Analytics and Crisp Live Chat may be leveraged for tracking user interactions or facilitating social engineering. The domain is registered through OVH, SAS, a provider frequently associated with both legitimate and malicious infrastructure. The exact content and functionality of the site have not been fully analyzed, but the combination of brand impersonation, active status, and detection by multiple security vendors indicates a high-risk threat. Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where Kraken or cryptocurrency-related services are accessed. Monitoring for related domains or IPs associated with the same infrastructure (e.g., 216.150.1.193) may help identify additional threats. Given the domain's age and continued activity, it is likely part of a persistent campaign rather than a short-lived operation.