access-en-us-keraken[.]daftpage[.]com

The domain access-en-us-keraken.daftpage.com is currently active and classified as a high‑risk brand‑impersonation threat targeting Kraken users. Infrastructure analysis shows the domain resolves to IP 216.150.1.65, hosted on an Amazon.com, Inc. (AS16509) network located in the United States. The site uses a Let’s Encrypt R13 certificate and returns an HTTP 308 redirect, indicating a permanent move to another location. It is registered through OVH, SAS, with authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. Technical fingerprints reveal a Node.js stack powered by React and Next.js, hosted on Vercel, with HSTS enforced, Google Analytics present, and a Crisp Live Chat widget. The page title captured is "Kraken Login Troubleshooting: A Step," and the campaign is identified as a crypto‑scam employing a seed‑phrase phishing kit. Security telemetry shows 16 of 95 VirusTotal scanners flag the domain, Google Safe Browsing reports a social‑engineering warning, and Gridinsoft assigns a trust score of 0/100. The domain appears on one external blocklist and has been blocked by PhishDestroy. While the exact content of the landing page has not been examined, the combination of brand impersonation, crypto‑focused lure, and the seed‑phrase kit suggests an attempt to harvest private keys or login credentials. Defenders should add the domain and its resolving IP to network blocklists, monitor for related DNS queries, and enforce URL filtering for any Kraken‑related login URLs. Continuous observation of the hosting provider’s IP range is advised, as the attacker may redeploy similar pages on adjacent infrastructure.