Two security updates from October 30–31, 2026 show why domain trust needs attention: exposed customer details can support convincing phishing, while DNS hijacking can redirect visitors who enter the correct web address.
Chainalysis: customer details can become phishing material
Chainalysis disclosed that an attacker accessed customer user IDs, names, email addresses, and organization role labels. Based on its investigation to date, it found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens.
Our assessment: names and roles can make fake support messages and password-reset requests more convincing. This is a potential follow-on risk, not confirmation of an active phishing campaign. Chainalysis advised users to watch for unexpected reset requests or authentication prompts and enable two-factor authentication.
Flap and Kintsu: a familiar domain can become a trap
The CertPing updates linked below summarize reports of DNS hijacking at Flap and Kintsu. Blockaid flagged the two websites and ten additional sites serving a wallet drainer. These reports concern the website access layer: an application's underlying contracts can remain operational while its web interface puts visitors at risk.
An unauthorized DNS change can send customers to an attacker-controlled destination even when they type the correct address. Initial incident reports should not be treated as a completed root-cause investigation.
Five controls to review now
- Protect registrar and DNS accounts. Enable phishing-resistant MFA where available, restrict administrative access, and review recovery contacts and API credentials.
- Monitor domain changes. Alert on unexpected nameserver, A/AAAA, CNAME, MX, and email-authentication record changes. Assign a responder who can investigate promptly.
- Enforce email authentication carefully. Inventory legitimate senders, validate aligned SPF or DKIM, and review DMARC reports before moving to a stricter policy.
- Understand DMARC's limits. A p=reject policy asks receiving mail systems to reject messages that fail DMARC for your domain. It does not stop lookalike domains, display-name impersonation, compromised legitimate mailboxes, or DNS hijacking.
- Prepare customer guidance. Ask users to verify unexpected reset prompts through a known channel. Maintain an established incident communication channel separate from the primary website.
Make domain trust part of daily operations
Domain ownership, DNS configuration, email authentication, and phishing response need clear owners. Start with a baseline of your critical domains and a process for reviewing unauthorized changes.
How CertPing® helps protect your domain and brand
CertPing® is the domain trust platform, bringing domain registration and management, DNS, SSL certificates, email checks, anti-phishing, and trademark watch into one dashboard.
- Email security: Check SPF, DKIM, and DMARC and get suggested DNS records to address missing or weak configuration. Receiving mail servers enforce the policy you publish.
- Anti-phishing monitoring: Check new domain registrations daily for names that imitate yours, with a reason and risk level for each finding. Your first domain is watched free. Detection supports investigation; it does not automatically block or take down a domain.
- Managed DNS: Manage DNS records with DNSSEC alongside your domain. Combine these controls with strong account authentication and review of administrative access.
- SSL certificates: Issue certificates for domains you own and track renewal dates from the dashboard. Free Let's Encrypt certificates are renewed from the dashboard; paid automatic renewal is available on request.
- Trademark search and watch: Look for similar USPTO marks, watch new filings, and start an attorney-assisted trademark application.
Your name, protected. Visit certping.com to check your domain's email security, watch for look-alikes, and manage the foundations of domain trust.
Sources
- Chainalysis security incident disclosure — October 30, 2026
- Blockaid initial frontend attack alert
- Blockaid expanded website alert
- CertPing: Chainalysis and phishing risk
- CertPing: DNS hijacking and registrar protection
Prepared October 31, 2026. Findings may change as investigations continue.
