docs-kraken-help[.]zapier[.]app

This domain, docs-kraken-help.zapier.app, poses as the official Kraken cryptocurrency exchange login portal to harvest user credentials. Analysis indicates it presents a fraudulent "Kraken Pro Login – Secure Access" page, designed to deceive visitors into entering their account details. Such infrastructure is commonly used in credential theft operations, where stolen logins are exploited to drain crypto wallets or conduct unauthorized transactions. The threat primarily targets users seeking quick access to trading platforms, leveraging urgency and familiarity with the brand to bypass caution. Infrastructure analysis reveals the domain was hosted on Amazon Web Services (AS16509) at IP 64.239.123.129, with a Let's Encrypt SSL certificate (R12) to appear legitimate. It is flagged by 19 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain was registered through Name.com, Inc., and appears on at least one security blocklist. Its current offline status suggests takedown action, but similar domains may re-emerge using comparable tactics. Users who visited this domain should assume their credentials were compromised. Immediate steps include changing passwords for any accounts accessed via the fake portal, enabling multi-factor authentication (MFA) on all crypto-related services, and monitoring for unauthorized transactions. If financial losses occurred, report the incident to relevant authorities and the impersonated platform (Kraken) for further investigation. Avoid interacting with domains resembling official services unless verified through direct navigation to the legitimate site.