teach-kraken-web[.]daftpage[.]com

Analysis conducted on July 24, 2026 identifies teach-kraken-web.daftpage.com as an active infrastructure used for a Kraken brand impersonation campaign. The site presents the page title “Square: Sign in to Your Dashboard & Manage your Business”, a title unrelated to Kraken, suggesting a deceptive overlay to lure victims. Technical fingerprinting shows the site runs on a Node.js stack with React, Next.js, and Vercel hosting; Google Analytics and Crisp Live Chat are also present, indicating a typical phishing kit deployment. The domain was created on 24 October 2021 through the OVH SAS registrar and resolves to IP 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) in the United States. SSL is provided by Let’s Encrypt (R13), and the HTTP response code is 308, indicating a permanent redirect that may be used to forward traffic to the malicious payload.

The campaign leverages a “Seed Phrase Phishing” kit, a known method for harvesting cryptocurrency recovery phrases. Gridinsoft assigns a trust score of 0/100, reflecting extreme malicious confidence, and the domain appears on a single security blocklist. VirusTotal reports that 16 of 95 scanning engines flag the domain, reinforcing the malicious classification. PhishDestroy already blocks the site, yet the infrastructure remains live, suggesting evasion of some defenses. At present, no screenshots of the login interface have been captured, and the exact phishing flow—whether credentials are submitted directly or via a secondary redirect—remains unverified.

Defenders should block both the domain and the resolving IP at the network perimeter, enforce TLS inspection to detect the 308 redirect, and monitor for traffic to Vercel DNS nameservers. Email gateways should be tuned to detect references to “Square” login prompts that originate from this domain, as the page title may be used in lure content.