navi-kraken-web[.]framer[.]media

Analysis of navi-kraken-web.framer.media, first observed after registration on 21 February 2026, indicates that the domain was used to host a fraudulent page impersonating the cryptocurrency exchange Kraken. The site resolved to the Amazon Web Services IP address 35.71.142.77, which belongs to AS16509 (Amazon.com, Inc.) and is physically located in the United States. DNS resolution was provided by the four AWS‑hosted name servers ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-1 (truncated in the source). The web server presented a Let’s Encrypt certificate issued under the E7 identifier, and the connection employed HSTS and HTTP/3, consistent with modern web frameworks. Technology fingerprinting identified Framer Sites and a React front‑end, confirming that the page was generated with the Framer web‑design platform.

Google Safe Browsing flagged the URL for social engineering, and PhishDestroy added the domain to its blocklist, resulting in a single security blocklist entry at the time of reporting. VirusTotal scans returned 13 positive detections out of 95 vendors, reinforcing the malicious classification. The HTTP response returned a 404 status code with the page title “Site Not Found | Framer”, suggesting that the content was removed or taken offline. The registrar listed for the domain is CSC Corporate Domains, Inc., a bulk registrar often leveraged for rapid domain acquisition.

The available evidence points to a crypto‑related scam that sought to exploit Kraken’s brand reputation, although the exact payload or credential‑harvesting mechanism has not been captured. Because the site is currently offline, active mitigation is limited to ensuring that the domain remains listed on blocklists and that endpoint protection solutions continue to recognize the 13 VirusTotal detections. Defenders should monitor for re‑registration of the domain or the appearance of similar sub‑domains under the framer.