welcome-kraken-helps[.]daftpage[.]com

The domain welcome-kraken-helps.daftpage.com is currently active and has been identified as a high‑risk brand‑impersonation site targeting Kraken users. DNS resolution points to IP address 216.150.16.129, which belongs to AS16509 Amazon.com, Inc. and is geolocated in the United States. The domain was registered on 24 October 2021 through OVH, SAS, and uses the authoritative name servers ns1.vercel-dns.com and ns2.vercel-dns.com, indicating hosting on the Vercel platform. An HTTP 308 permanent redirect is returned, and the site presents a TLS certificate issued by Let’s Encrypt (R13). Automated analysis on VirusTotal shows that 7 of 95 security vendors flagged the domain, and it appears on one public blocklist, with PhishDestroy already listing it as blocked. Technology fingerprints reveal a Node.js runtime serving a React/Next.js application, with embedded YouTube content, Google Analytics tracking, HSTS enforcement, and Crisp Live Chat widgets. The page title “Support Center | Kraken” aligns with the declared brand target, Kraken, confirming a brand‑impersonation attempt. The associated scam type is a crypto‑related scam, though the exact malicious payload or credential‑harvesting mechanism has not been observed. While the infrastructure details are concrete, the content served beyond the title has not been publicly examined, leaving the specific tactics (e.g., phishing forms or malware delivery) uncertain. Defenders should block the domain at DNS and network layers, monitor traffic to the associated IP, and add the domain to endpoint allow‑lists as malicious. Continuous re‑evaluation is advised in case the site evolves, and any observed credential submissions should be reported to the affected brand’s abuse team.