kraken-logi[.]framer[.]media

Analysis of the domain kraken-logi.framer.media indicates a high-risk phishing campaign impersonating the cryptocurrency exchange Kraken. The domain was registered through CSC Corporate Domains, Inc., and its infrastructure is hosted on Amazon Web Services (AS16509), resolving to the IP address 35.71.142.77, located in the United States. The domain's nameservers are associated with AWS (ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-1267.awsdns-40.org), a common hosting provider for both legitimate and malicious sites. The page title, "Login - krakenportal.com," explicitly suggests an attempt to mimic Kraken's login portal, aligning with the reported scam type of a crypto scam. Google Safe Browsing has flagged this domain for social engineering, a classification consistent with phishing activity targeting financial credentials. The domain was created on November 19, 2021, though its malicious use appears to have been detected more recently.

At the time of analysis, the domain returned an HTTP 404 status, indicating it is no longer serving active content. However, this does not preclude the possibility of reactivation or reuse of the infrastructure. The SSL certificate is issued by Let's Encrypt (serial number E7), a widely used certificate authority that does not inherently indicate malicious intent but is frequently leveraged by threat actors due to its accessibility. Detection by security vendors is notable, with 13 of 95 engines on VirusTotal flagging the domain as malicious. Additionally, the domain appears on at least one security blocklist and is blocked by PhishDestroy, further corroborating its classification as a phishing threat.

Defenders should note that the domain's use of Framer Sites and React, combined with HTTP/3 and HSTS, suggests an attempt to appear legitimate and evade basic detection mechanisms.