verifications-kraken[.]com

This domain, verifications-kraken.com, poses a direct threat as a brand impersonation scam targeting users of the Kraken cryptocurrency exchange. The site presents itself as a legitimate wallet verification portal under the title 'Verify Wallet - Kraken,' designed to deceive users into entering sensitive credentials or wallet recovery phrases. Analysis indicates the domain is structured to mimic official Kraken authentication flows, likely intended to harvest login details or facilitate unauthorized transactions, including potential crypto asset drainage. The threat aligns with known tactics used in cryptocurrency phishing campaigns, where attackers exploit trust in established brands to execute fraudulent activities. Technical evidence confirms the malicious nature of this domain. VirusTotal reports 20 out of 95 security vendors flagging verifications-kraken.com as malicious, a significant detection rate indicative of confirmed phishing activity. The domain was registered on February 21, 2026, through NameSilo, LLC, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to the IP address 64.94.85.47, hosted under AS399629 (BL Networks) in the United States. The domain appears on three independent security blocklists and lacks an SSL certificate, further reducing its legitimacy. The creation date, combined with the absence of encryption, suggests a short-lived, disposable infrastructure typical of phishing operations. Users who visited verifications-kraken.com or interacted with its content should take immediate action to mitigate potential risks. If credentials or wallet recovery phrases were entered, affected users must transfer assets to a new, secure wallet and revoke any connected authorizations or API keys associated with the compromised account. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to the targeted brand’s official security team for further investigation and potential takedown coordination. Avoid reusing passwords or recovery phrases across platforms, and verify domain authenticity by cross-referencing official communication channels before entering sensitive information.