sso-eng-kraken[.]daftpage[.]com

This domain sso-eng-kraken.daftpage.com is currently active and returns HTTP 308 redirects. The site is secured with a Let’s Encrypt certificate (R13) and is hosted on a Vercel edge node that resolves to IP 216.150.1.193, an Amazon.com, Inc. address located in the United States. Registration data shows the domain was created on 24 Oct 2021 through OVH, SAS, and it uses Vercel DNS nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The page title advertised as “Kraken Login || Secure Your Crypto: Best Practices for Safe Kraken Login” explicitly references the Kraken brand, indicating a brand‑impersonation campaign aimed at cryptocurrency users. Technical fingerprints reveal a Node.js stack with React, Next.js, and integration of Google Analytics, Crisp Live Chat, and YouTube embeds, all typical of a modern phishing kit. VirusTotal reports 11 of 95 scanners flag the domain, and it appears on at least one public blocklist, with PhishDestroy already listing it as blocked. The threat is classified as a crypto‑related scam. While the exact page content has not been captured, the combination of brand‑targeted title, infrastructure, and detection history suggests a high‑risk impersonation attempt. Defenders should add the domain to network and email denial lists, monitor outbound connections to the associated IP, and enforce strict verification of Kraken communications. Continuous scanning of the host and rapid removal from allow lists are recommended.