prime-kraken-us-eng[.]daftpage[.]com

Analysis of prime-kraken-us-eng.daftpage.com confirms active brand impersonation targeting Kraken, a cryptocurrency exchange. The domain, registered on October 24, 2021, through OVH, SAS, resolves to IP address 216.150.16.129 and is currently flagged on one security blocklist. The page title, 'Kraken: Buy and sell crypto securely,' directly mirrors the legitimate exchange's branding, indicating an intent to deceive users into believing the site is authentic. Infrastructure analysis reveals the use of Node.js, React, Next.js, and Vercel, common technologies for modern phishing sites that enable dynamic content and rapid deployment. The presence of Google Analytics and Crisp Live Chat suggests efforts to track user interactions and engage victims in real time. The domain's SSL certificate is issued by Let's Encrypt, a legitimate provider often exploited by malicious actors to create a false sense of security. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. VirusTotal reports 14 of 95 security vendors flagging the domain as malicious, though this number reflects only partial coverage and should not be interpreted as exhaustive. The domain remains active as of July 12, 2026, with no evidence of takedown or mitigation. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activity is prohibited or monitored. Given the use of Vercel and HSTS, the site may employ evasion techniques such as rapid domain rotation or subdomain generation. Security teams should correlate this domain with other indicators, such as the resolving IP (216.150.16.129) and associated technologies, to identify related infrastructure. No additional details about the specific phishing kit or payload delivery mechanism are available at this time.