website-krakenio[.]daftpage[.]com

This domain, website-krakenio.daftpage.com, poses a significant credential theft risk by impersonating the Kraken cryptocurrency exchange. The site presents a fraudulent login interface designed to mimic the legitimate Kraken platform, tricking users into entering their account credentials. Once submitted, these credentials are captured by threat actors, enabling unauthorized access to victims' cryptocurrency wallets and personal information. The page title, 'Official Site® | Kraken Login® - Kraken,' reinforces the deception by falsely asserting authenticity, increasing the likelihood of successful phishing attempts. Analysis indicates this domain is part of a coordinated phishing campaign targeting Kraken users. The domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.16.65, hosted on Amazon.com, Inc. infrastructure (AS16509). Detection metrics further confirm its malicious nature, with 19 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate, issued by Let's Encrypt (R13), provides a veneer of legitimacy but does not mitigate the underlying threat. Users who visited website-krakenio.daftpage.com or entered credentials on the site should take immediate action to secure their accounts. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. Next, change the passwords for the affected Kraken account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all accounts to add an additional layer of security. Monitor the Kraken account for unauthorized transactions or suspicious activity, and report any anomalies to Kraken's official support channels. If financial loss is suspected, contact local law enforcement or cybercrime reporting agencies to file a complaint.