kraken-start[.]framer[.]media

Analysis of kraken-start.framer.media indicates a high‑risk brand‑impersonation campaign targeting Kraken users. The domain, registered through CSC Corporate Domains, Inc. on November 19, 2021, resolves to IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site presents a TLS certificate issued by Let’s Encrypt (E7) and is served via modern protocols including HSTS and HTTP/3, with underlying technologies identified as Framer Sites and React. An HTTP request returns a 404 status and the page title "Site Not Found | Framer," suggesting the content has been taken offline at the time of assessment.

Despite the offline state, external threat intelligence shows active detection: Google Safe Browsing flags the domain for social engineering, twelve of ninety‑five VirusTotal vendors have reported it as malicious, and it is listed on one security blocklist. The domain is also blocked by PhishDestroy. The campaign is classified as a crypto scam, leveraging Kraken’s brand to deceive victims.

Defenders should block the domain and its resolved IP at perimeter firewalls, update URL filtering policies to include kraken-start.framer.media, and monitor for any resurgence of active content. Continuous observation of the associated Amazon nameservers (ns-97.awsdns-12.com, ns-1267.awsdns-30.org, ns-535.awsdns-02.net, ns-1854.awsdns-39) is advised, as they may be reused for future malicious deployments. Given the existing vendor detections and Safe Browsing flag, the domain should be treated as malicious until a formal takedown confirmation is received.