secure-kraken-sso-en[.]daftpage[.]com

This domain, secure-kraken-sso-en.daftpage.com, is identified as a high-risk brand impersonation threat targeting the cryptocurrency exchange Kraken. Analysis indicates the domain was specifically designed to mimic legitimate Kraken single sign-on (SSO) portals, presenting users with fraudulent login interfaces to harvest credentials. The domain is currently offline, but prior activity confirms its malicious intent. Infrastructure analysis reveals the domain was registered through OVH, SAS on October 24, 2021, and resolved to the IP address 216.150.1.193. The SSL certificate was issued by Let's Encrypt (R13), a common tactic to lend superficial legitimacy to phishing sites. Detection metrics show the domain was flagged by 15 of 95 security vendors on VirusTotal, while Google Safe Browsing explicitly classified it as phishing. Additionally, the domain appeared on one security blocklist, further corroborating its malicious classification. The page title, 'Kraken - Kraken | Buy, Sell and Margin Trade Bitcoin …,' closely mirrors legitimate Kraken branding to deceive users. As of the latest assessment, secure-kraken-sso-en.daftpage.com has been taken offline, though residual risk may persist if users previously interacted with the domain. Organizations and individuals are advised to block the domain and its associated IP (216.150.1.193) at the network level. Users who may have entered credentials on this site should immediately reset their Kraken passwords and enable multi-factor authentication. Security teams should monitor for related domains registered through OVH or resolving to the same IP range, as threat actors often reuse infrastructure for successive campaigns.