ens-tech-kraken[.]daftpage[.]com

The domain ens-tech-kraken.daftpage.com is presently active and hosts a site that presents the page title “Kraken: Buy and sell crypto securely”. The title directly mirrors the legitimate Kraken branding, confirming a brand‑impersonation attempt aimed at crypto‑related victims. Registration data shows the domain was created on 24 October 2021 through OVH, SAS, a common registrar for disposable infrastructure. DNS resolution points to the Vercel‑managed nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, and the A record resolves to 216.150.16.129, an IP address owned by Amazon.com, Inc. (AS16509) and located in the United States. The site is served over HTTPS with a Let’s Encrypt R13 certificate, indicating a valid TLS handshake but offering no protection against the underlying fraud.

Infrastructure analysis identifies a modern web stack: Node.js, React, Next.js, and Vercel hosting, with ancillary services such as YouTube embeds, Google Analytics tracking, and Crisp live‑chat widgets. HTTP responses return a 308 permanent redirect, suggesting intentional URL normalization. Security hygiene is poor; Gridinsoft assigns a trust score of 0 / 100, and the domain appears on at least one public blocklist. VirusTotal scans have flagged the host on 13 of 95 engines, reinforcing the malicious classification. PhishDestroy already lists the domain as blocked, confirming community awareness of the threat.

The primary uncertainty lies in the exact payload delivered after redirection; no direct evidence of credential‑capture forms or malicious binaries has been observed in the supplied data. Analysts should therefore treat any interaction with the site as potentially hazardous and enforce blocking at the network perimeter. Recommended mitigations include adding the domain and its resolved IP to deny lists, monitoring for outbound connections to the identified Vercel endpoint, and ensuring endpoint protection solutions are updated with the latest threat intel.