us-kraken-help[.]framer[.]media

Analysis of the domain us-kraken-help.framer.media indicates it is a brand impersonation site targeting Kraken, a cryptocurrency exchange platform. The domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and resolves to the IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. The page title, 'Sign in : Kraken,' directly mimics the legitimate Kraken login portal, reinforcing its classification as a crypto scam. As of July 25, 2026, the domain is offline, returning an HTTP 404 status. Infrastructure analysis reveals the use of Framer Sites and React, alongside HSTS and HTTP/3 protocols.

The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist, PhishDestroy, and was flagged by 10 of 93 security vendors on VirusTotal, confirming its malicious classification. No additional details about the scam mechanics (e.g., credential harvesting, wallet-draining scripts) are available, as the site content was not analyzed before takedown. Defenders should treat this domain as a confirmed threat.

Blocklist the domain and IP 35.71.142.77 at perimeter security controls. Monitor for related subdomains or newly registered lookalike domains using the same hosting provider or registrar. Given the use of AWS nameservers (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-97.awsdns), consider reviewing AWS-hosted domains with similar naming patterns for potential fraud. The domain's offline status reduces immediate risk, but historical logs should be checked for prior connections from internal assets.