faq-kraken-us-portal[.]daftpage[.]com

PhishDestroy assesses faq-kraken-us-portal.daftpage.com as a high-risk threat, specifically a brand impersonation attack targeting Kraken. This domain was designed to deceive users into believing they were interacting with the legitimate Kraken cryptocurrency exchange, likely to harvest login credentials or other sensitive information. The site has since been taken offline, but its infrastructure and indicators provide critical insight into the tactics used by threat actors.

Technical analysis reveals that the domain was registered through OVH, SAS, and created on October 24, 2021. It resolved to IP address 216.150.16.193 and used an SSL certificate from Let's Encrypt (R13) to appear legitimate. VirusTotal flagged the domain with 10 out of 95 security vendors, and it appeared on one security blocklist. Google Safe Browsing specifically marked it as phishing. The page title, "Kraken | Buy, Sell and Margin Trade Bitcoin…", closely mimicked Kraken's official branding, reinforcing the impersonation attempt.

To protect against such brand impersonation threats, users should always verify URLs before entering credentials, especially on cryptocurrency platforms. Enable two-factor authentication on all accounts and avoid clicking links in unsolicited messages. If you suspect you have interacted with a phishing site, change your passwords immediately and contact the legitimate company's support team. PhishDestroy recommends using browser extensions that block known phishing domains and regularly monitoring account activity for unauthorized access.