daft-cd-us-kraken[.]daftpage[.]com

This domain, daft-cd-us-kraken.daftpage.com, is actively impersonating the Kraken cryptocurrency exchange platform as of July 12, 2026. Analysis indicates it is classified as a high-risk brand impersonation threat, with the page title explicitly displaying 'Kraken Login* | Official Account Access.' The domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.16.129. It is currently flagged on one security blocklist and has been identified by 7 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt, and the domain employs multiple technologies, including Node.js, React, Next.js, and Google Analytics, which may be used to enhance the appearance of legitimacy or track victim interactions. Infrastructure analysis reveals the site is hosted on Vercel and includes Crisp Live Chat, a feature often exploited in phishing campaigns to provide false support or manipulate victims into divulging credentials. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious classification. While the domain remains active, defenders should prioritize blocking it at the DNS or network level, particularly in environments where Kraken or cryptocurrency-related services are used. No evidence currently suggests the use of a specific phishing kit or additional payload delivery, but the domain's structure and branding align with credential harvesting tactics. Organizations should monitor for any attempts to access this domain from internal networks and investigate potential credential exposure if interactions are detected.