en-tech-krken[.]daftpage[.]com

The domain en-tech-krken.daftpage.com is currently active and serves a page titled “Kraken: Buy and sell crypto securely”. HTTP responses return a 308 redirect, and the site is hosted on Vercel infrastructure, as indicated by the nameservers ns1.vercel-dns.com and ns2.vercel-dns.com and the presence of Node.js, React, Next.js, and HSTS in the technology stack. DNS resolution points to IP 216.150.16.193, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain was registered on 24 October 2021 through OVH, SAS. Security analysis shows that 12 of 95 VirusTotal scanners flagged the domain and Gridinsoft assigns a trust score of 0 / 100. The site uses a Let’s Encrypt R13 certificate and appears on a single security blocklist. It is classified as a crypto‑related brand impersonation campaign targeting Kraken, employing a seed‑phrase phishing kit. The domain is already blocked by PhishDestroy. While the page title and infrastructure details confirm a credential‑harvesting intent, the exact content of the phishing page has not been publicly disclosed, leaving the specific user‑interaction flow uncertain. Defenders should block the resolved IP address and the domain at DNS and network layers, monitor for related Vercel‑hosted subdomains, and update detection signatures to include the observed SSL certificate fingerprint and the 12 VirusTotal detections. Continuous observation of the OVH registrar for any new domains sharing similar naming patterns is also recommended.