kraken-cd-en-learn[.]daftpage[.]com

This domain, kraken-cd-en-learn.daftpage.com, is identified as a high-risk brand impersonation threat targeting the Kraken cryptocurrency exchange. Analysis indicates the site was designed to harvest user credentials by mimicking the official Kraken login interface, specifically replicating the page title 'Sign in to Kraken - Kraken | Buy, Sell and Margin Trade Bitcoin …'. No direct evidence of a crypto drainer kit was observed, but the credential theft functionality aligns with common pre-drainer attack vectors used to gain unauthorized access to user accounts. Technical indicators confirm the domain's malicious nature. The domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.1.65, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Google Safe Browsing explicitly flags the domain as phishing, and it appears on at least one security blocklist. VirusTotal detection rates show 17 out of 95 security vendors marking the domain as malicious, with a focus on phishing and brand impersonation. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its accessibility. As of the latest assessment, kraken-cd-en-learn.daftpage.com has been taken offline, reducing immediate risk to users. However, the infrastructure used—including the registrar and hosting provider—remains active and may be repurposed for future campaigns. Users who interacted with the domain are advised to rotate credentials immediately, enable multi-factor authentication on all financial and crypto-related accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.