help-kraken-en-help[.]daftpage[.]com

help-kraken-en-help.daftpage.com is currently active and serves a page titled “Kraken: Buy and sell crypto securely”. The site is hosted on Vercel infrastructure, indicated by the authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com and the presence of Node.js, React, Next.js, and HSTS in the technology fingerprint. The domain was registered through OVH SAS on 24 October 2021 and resolves to the IP address 216.150.16.129, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. HTTPS is provided by a Let’s Encrypt R13 certificate. The HTTP response code 308 suggests a permanent redirect is in use. Security scanners flag the domain as malicious: 16 of 95 VirusTotal engines raise detections, Google Safe Browsing lists it under “SOCIAL_ENGINEERING”, and Gridinsoft assigns a trust score of 0/100. The domain appears on a single blocklist and is already blocked by PhishDestroy. The page impersonates the Kraken brand and is categorized as a crypto‑related scam. The available evidence confirms a high‑risk brand‑impersonation operation that is actively serving malicious content. However, the exact payload, credential‑collection mechanism, and any downstream infrastructure have not been publicly disclosed. Defenders should block the domain and its resolving IP at network perimeters, monitor DNS queries for the domain and its nameservers, and add the host to threat‑intel feeds. Continuous re‑scanning is recommended to capture any changes in the malicious payload.