kraken[.]daftpage[.]com

kraken.daftpage.com is an active domain that hosts a credential‑harvesting page titled “Log‑in | Kraken.com”, indicating a direct impersonation of the Kraken cryptocurrency exchange. The site was registered on 24 Oct 2021 through OVH, SAS and is served from the IP address 216.150.16.129, which belongs to Amazon’s ASN 16509 and is physically located in the United States. DNS resolution uses Vercel’s name servers (ns1.vercel‑dns.com, ns2.vercel‑dns.com). The web server presents a valid TLS certificate issued by Let’s Encrypt (R13) and enforces HSTS, while the HTTP response code is 308, suggesting a permanent redirect. Infrastructure fingerprints reveal a stack built on Node.js, React, Next.js and hosted on Vercel, with embedded YouTube, Google Analytics and Crisp Live Chat scripts. VirusTotal scans show six of ninety‑five AV engines flagging the domain as malicious, and the Gridinsoft trust score is 0 / 100. The domain appears on at least one public blocklist and has been flagged by PhishDestroy. The listed scam type is “Crypto Scam”, consistent with the Kraken brand impersonation. No additional page content has been publicly disclosed, so the exact payload remains unverified. Defenders should block kraken.daftpage.com and its host IP 216.150.16.129 at the network perimeter, add the domain to internal URL filtering and phishing protection lists, and monitor for any DNS or TLS certificate changes. Continuous observation of the Vercel name servers for new sub‑domains is advised, as the same infrastructure may be reused for related campaigns.