my-kraken-s-cdn[.]framer[.]ai

On July 24 2026 the domain my-kraken-s-cdn.framer.ai was observed hosting a page whose title reads “Sign In | Kraken.com”. The title and the classification as a Crypto Scam indicate a targeted impersonation of the Kraken cryptocurrency exchange. The domain is registered through CSC Corporate Domains, Inc. and was created on 06 January 2018. DNS resolution points to the IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The name servers listed are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns, confirming that the infrastructure is hosted on AWS.

An HTTPS service is present with a Let’s Encrypt certificate issued by the E8 intermediate, indicating a valid TLS configuration that includes HSTS and HTTP/3 support. The underlying web stack includes Framer Sites and React, matching the technology fingerprint of the host. VirusTotal reports that four of ninety‑five scanning engines flag the domain, providing independent confirmation of malicious activity. The domain appears on the PhishDestroy blocklist, further corroborating its reputation as a phishing vector. HTTP probing returns a 404 status code, which may be the result of the site being taken offline; the current status is recorded as offline.

Evidence confirms that the domain is being used to impersonate Kraken for a crypto‑related scam, but no additional details about the payload or credential‑harvesting mechanism have been released. Defenders should block the domain and its associated IP address at network perimeters, add the observed name servers to threat‑intel feeds, and monitor for any future resolution to new AWS endpoints. Continuous re‑scanning on VirusTotal and inclusion in internal allow‑list exclusions are recommended to maintain visibility. Since the site is already offline, further investigation of archived content may be required to extract any malicious scripts or URLs that were previously served.