helps-kraken-auth[.]framer[.]ai

The domain helps-kraken-auth.framer.ai is identified as a brand impersonation site targeting Kraken, a reputable cryptocurrency trading platform. It is currently offline, but previous analysis indicates a significant threat to users.

Infrastructure analysis reveals that the domain was registered through CSC Corporate Domains, Inc. on January 06, 2018. The domain resolves to the IP address 52.223.52.2, which is located in the United States and belongs to Amazon.com, Inc. (AS16509). The site was flagged by 9 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion. Google Safe Browsing has also marked the domain as a phishing site, and it appears on 1 security blocklist. The SSL certificate is issued by Let's Encrypt, which is a common certificate authority used by both legitimate and malicious sites.

Given the current offline status, there is a reduced immediate risk to users. However, the domain remains a known threat and could be reactivated at any time. Security experts recommend that users avoid accessing this domain and report any suspicious activity to Kraken or their cybersecurity team. Additionally, network administrators should consider blocking access to this domain at the network level to prevent potential reactivation and user exposure.