public-krakn-v-docs[.]daftpage[.]com

The domain public-krakn-v-docs.daftpage.com is flagged for brand impersonation, specifically targeting the cryptocurrency exchange Kraken. The threat type is high, and the domain was used to impersonate the Kraken login page, potentially to steal user credentials and financial information.

Analysis indicates that the domain has a VirusTotal score of 12/95, suggesting a significant level of suspicion among security vendors. The domain was registered through OVH, SAS and resolves to the IP address 216.150.16.1, which is located in the United States and is part of the AS16509 network operated by Amazon.com, Inc. The domain was created on October 24, 2021, and is flagged by Google Safe Browsing for phishing. Additionally, it appears on one security blocklist and uses an SSL certificate from Let's Encrypt / R13, which can lend a false sense of security to unsuspecting users.

The domain is currently offline, and the necessary response actions have been taken to mitigate the threat. However, the infrastructure used for the attack, such as the IP address and registrar, should be monitored for any further malicious activities. Despite the domain being taken offline, users who may have interacted with it before it was shut down are still at risk. It is recommended to change passwords and monitor account activity for any unauthorized transactions. Security teams should also be vigilant and continue to track similar domains and IP addresses to prevent future incidents.