doc-hel-kraken[.]daftpage[.]com

This technical threat report details a malicious domain impersonating the Kraken cryptocurrency brand. The site, titled 'Kraken Login Troubleshooting: A Step-by', was designed as a cryptocurrency scam, posing as a legitimate Kraken support or login page to trick users into providing credentials or sensitive financial information. The primary threat is credential theft and account compromise, facilitated by social engineering aimed at cryptocurrency users.

Technical evidence shows the domain is flagged by 8 out of 95 VirusTotal vendors, including CyRadar, Fortinet, G-Data, Seclookup, and SOCRadar. Google Safe Browsing has flagged the site for SOCIAL_ENGINEERING. The domain was created on 2021-10-24, registered through OVH, SAS, and resolves to IP address 216.150.1.1 in the United States, hosted on AS16509 Amazon.com, Inc. SSL certificate is issued by Let's Encrypt / R13, and nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com. Cloaking technique 'content_split' was detected, indicating the site served different content to scanners versus users.

Currently the domain is DOWN or OFFLINE, limiting immediate risk. However, the GridinSoft trust rating is 0 out of 100, and the DOM risk score is 10, indicating a severe threat when active. The site is listed on 1 blocklist. Risk level is high for users who may have attempted to access the site while it was active, as it posed a direct social engineering threat targeting Kraken account credentials.