krakcencdn[.]framer[.]ai

The domain krakcencdn.framer.ai was registered on 21 February 2026 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 52.223.52.2, which belongs to ASN 16509 (Amazon.com, Inc.) in the United States. The site presents the page title “Kraken Login Portal | Instant Access to Your Digital Assets”, a wording that directly references the cryptocurrency exchange Kraken and suggests a credential‑collection portal. The TLS certificate is issued by Let’s Encrypt (identifier E8), and the server advertises HTTP Strict Transport Security and HTTP/3, indicating a modern web stack built on Framer Sites and React. An HTTP request returned a 404 status, and the domain is currently taken offline.

Reputation services show mixed signals: Google Safe Browsing classifies the URL as a social‑engineering threat, PhishDestroy has added it to its blocklist, and the domain appears on one additional security blocklist. VirusTotal analysis recorded detections from eight of ninety‑three scanning engines, reinforcing the malicious assessment. The observed infrastructure—single AWS IP, commercial registrar, and use of a legitimate certificate—mirrors typical credential‑harvesting campaigns that rely on trusted hosting to evade naïve scrutiny.

At present, no public samples of the page content or phishing kit have been released, so the exact method of credential capture remains unknown. Defenders should immediately denylist krakcencdn.framer.ai and the associated IP 52.223.52.2, monitor for new subdomains under the same nameserver set (ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org), and continue to track any future VirusTotal or Google Safe Browsing updates. Because the domain uses a valid TLS certificate, network‑level inspection of HTTPS traffic or SSL inspection may be required to detect subsequent malicious payloads if the site is re‑hosted.