securely-eng-kraken[.]daftpage[.]com

The domain securely-eng-kraken.daftpage.com has been identified as a brand impersonation phishing site targeting Kraken, a well-known cryptocurrency exchange. This threat is categorized as high risk due to its deceptive nature, aiming to steal login credentials from unsuspecting users. The site's title, 'Kraken Login Troubleshooting: A Step-sec,' suggests it mimics legitimate support or troubleshooting pages to lure victims. No specific drainer kit was identified, but the primary tactic is credential harvesting through a fake login interface.

Technical indicators confirm the malicious intent. VirusTotal reports 11 out of 95 security vendors flagging this domain as malicious, and Google Safe Browsing lists it as a phishing site. The domain resolves to IP address 216.150.16.193 and appears on one security blocklist. It was registered on October 24, 2021, through OVH, SAS, and uses a Let's Encrypt SSL certificate (R13), which provides a false sense of security. The domain's creation date and registrar details indicate it was set up specifically for this campaign.

As of the latest assessment, the site has been taken offline, which is a positive step in mitigating the threat. However, users should remain vigilant as similar domains may appear. PhishDestroy recommends that all users who may have interacted with this site change their Kraken passwords immediately and enable two-factor authentication. Always verify URLs directly by typing them into the browser rather than clicking links. For ongoing protection, use PhishDestroy's tools to check any suspicious links before engaging.