web-crypto-portal[.]daftpage[.]com

The domain web-crypto-portal.daftpage.com has been identified as a high-risk brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they were accessing legitimate Kraken services, potentially facilitating unauthorized transactions or credential theft. The domain is currently offline, but prior activity warrants further scrutiny. Infrastructure analysis reveals the domain was registered through OVH, SAS, and resolved to the IP address 216.150.16.129, hosted on Amazon.com, Inc.'s AS16509 network in the United States. The domain was created on October 24, 2021, and has since been flagged by 13 of 95 security vendors on VirusTotal as malicious. Google Safe Browsing classified the domain as phishing, and it appears on at least one security blocklist. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. The page title, 'Get Kraken | Buy & Sell 100s of Crypto | Buy Crypto On Kraken,' closely mimics the branding and messaging of the legitimate Kraken platform, increasing the likelihood of successful deception. The domain's current offline status reduces immediate risk, but the infrastructure remains a potential threat if reactivated. Organizations and individuals are advised to block the domain and its associated IP address (216.150.16.129) at the network level. Users who may have interacted with the domain should monitor their accounts for unauthorized activity, enable multi-factor authentication, and report any suspicious transactions to the legitimate platform. Security teams should review logs for connections to the domain or IP address and conduct retrospective analysis to identify potential compromise. Given the domain's history, vigilance is recommended in case of re-emergence under a similar or altered infrastructure.