support-kraken-cdn[.]daftpage[.]com

support-kraken-cdn.daftpage.com is an active malicious site that impersonates Kraken’s login portal. The page title explicitly references “Kraken.com Login - Buy, Sell and Margin Trade Bitcoin”, indicating a crypto‑related credential‑harvesting campaign. The domain was created on 24 Oct 2021 and is hosted on an Amazon Web Services address (216.150.1.1, AS16509 Amazon.com, Inc.) in the United States. TLS is provided by Let’s Encrypt (R13) and HSTS is enabled, which may give a false sense of legitimacy. Infrastructure details show registration through OVH SAS and DNS resolution via Vercel’s authoritative nameservers (ns1.vercel‑dns.com, ns2.vercel‑dns.com). The site runs a Node.js stack with React and Next.js, and loads external services such as YouTube, Google Analytics, and Crisp Live Chat, a pattern commonly observed in phishing kits. HTTP responses return a 308 permanent redirect, suggesting redirection logic to obscure the final landing page. Threat intelligence flags the domain on one security blocklist and it is currently listed by PhishDestroy. Reputation scoring is extremely low (Gridinsoft 0/100) and 11 of 95 VirusTotal scanners have flagged the host as malicious. The identified scam type is a crypto scam targeting Kraken users. No further forensic detail on the page content is available. Defenders should treat the domain as malicious, block it at network perimeter and DNS layers, and add it to endpoint and email filtering rules. Monitoring for additional subdomains that resolve to the same IP or share the Vercel DNS configuration is recommended, as the infrastructure could be reused for other credential‑stealing campaigns. Incident response teams should advise users to verify Kraken URLs and report any credential submissions to the legitimate service provider.