help-krakken-logn[.]framer[.]website

The domain help-krakken-logn.framer.website was created on 19 November 2021 and is registered through CSC Corporate Domains, Inc. Its authoritative name servers are ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com and ns-792.awsdns, indicating reliance on Amazon Route 53. DNS resolution points to the IP address 35.71.142.77, which belongs to ASN 16509 operated by Amazon.com, Inc. and is geolocated in the United States. The site presented a TLS certificate issued by Let’s Encrypt (certificate type E7), but an HTTP request returned a 404 status code, suggesting that the landing page is either removed or never existed at the time of testing. Automated fingerprinting identified the use of Framer Sites, a React‑based front‑end framework, together with enforced HSTS and support for HTTP/3.

The page title reported by the scanner is “sign in | kraken | login”, and the threat profile classifies the campaign as a crypto‑related brand impersonation targeting Kraken. VirusTotal recorded nine positive detections out of ninety‑five scanners, and the domain is listed on a single public blocklist. PhishDestroy has also taken the domain offline, and the current operational status is reported as offline. Evidence confirms that the infrastructure is typical of low‑cost, template‑driven impersonation campaigns, but no direct observation of credential‑stealing forms, malicious scripts, or post‑exploitation activity is available.

Consequently, the precise payload and victim interaction remain unverified. Defenders should block the domain and its resolved IP at network perimeters, add the host to internal URL filtering and reputation services, and monitor for other subdomains under the framer.website namespace that share the same name‑server set. Continuous brand monitoring for Kraken‑related keywords is advised, as the attacker may reuse the same template for future campaigns.