portal-kraken-eng[.]daftpage[.]com

This domain, portal-kraken-eng.daftpage.com, is actively engaged in high-risk brand impersonation targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was registered on October 24, 2021, through OVH, SAS, and currently resolves to the IP address 216.150.1.129. The page title, 'Sign in to Kraken - Kraken | Buy, Sell,' explicitly mimics the legitimate Kraken login interface, reinforcing its fraudulent intent. The site employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. Detected technologies include Node.js, React, Next.js, and Vercel, suggesting a modern, potentially sophisticated phishing infrastructure. HSTS is also present, which may be leveraged to enhance the appearance of authenticity. Defenders should note that this domain is flagged by 11 of 95 security vendors on VirusTotal and appears on at least one security blocklist. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. While the domain has been active since 2021, its continued operation as of July 2026 indicates persistent abuse. The presence of Google Analytics and Crisp Live Chat may be used for tracking victims or facilitating real-time interaction, a common tactic in phishing campaigns. No evidence currently links this domain to a specific phishing kit or broader campaign infrastructure. However, the use of Vercel for hosting aligns with observed trends in phishing operations leveraging cloud-based platforms for scalability and evasion. Defenders are advised to block the domain and its resolving IP at the network level, monitor for related subdomains or newly registered lookalike domains, and alert users to the impersonation risk. Further investigation into the hosting provider and registrar may yield additional indicators of compromise or infrastructure reuse.