secure-kraken-docs[.]daftpage[.]com

The domain secure-kraken-docs.daftpage.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting Kraken users. Infrastructure analysis shows the domain resolves to the IP address 216.150.16.129, hosted in the United States under AS16509 (Amazon.com, Inc.). The domain was created on 24 Oct 2021 and is registered through OVH, SAS, with authoritative name servers ns1.vercel-dns.com and ns2.vercel-dns.com. HTTP requests receive a 308 redirect, and the site presents a Let’s Encrypt R13 certificate. Security telemetry indicates the domain appears on one blocklist, is flagged by Google Safe Browsing for social engineering, and 14 of 95 VirusTotal scanners have reported malicious activity. Observed technologies include Node.js, React, Next.js, Vercel, HSTS, Google Analytics, and Crisp Live Chat. The page title "Log‑In | Kraken.com - Official" aligns with a crypto‑scam impersonation of the Kraken brand. The domain is already blocked by PhishDestroy, but its active status suggests it may still be reachable from uncatalogued networks. Defenders should block the resolved IP and associated CIDR ranges, deny DNS resolution for the domain, and monitor outbound connections to the identified name servers. Continuous validation of SSL certificate changes and periodic re‑scanning with VirusTotal are recommended to detect any evolution in the malicious payload or additional vendor detections.