portfolio-kraken-log[.]framer[.]ai

This domain, portfolio-kraken-log.framer.ai, was observed hosting a credential‑collection page that mimics the login interface of Kraken. The page title returned by the HTTP server is “Sign In | Kraken.com - Login* to my Account”, indicating a direct attempt to deceive Kraken users. The site was served over HTTPS using a Let’s Encrypt certificate (issuer E8), which provides valid TLS but does not guarantee legitimacy. DNS records show the domain is registered through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 52.223.52.2, belonging to AS16509 (Amazon.com, Inc.). The four authoritative name servers are ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org, and a fourth entry truncated in the source data.

Technology fingerprinting identified Framer Sites, React, HSTS, and HTTP/3, consistent with a modern web‑app stack but not indicative of malicious intent on its own. Security‑vendor scanning on VirusTotal flagged the domain in 9 of 93 engines, and it appears on a single external blocklist, suggesting that multiple security products have identified it as malicious. PhishDestroy has already taken the site offline, and current HTTP response codes return 404, confirming that the content is no longer reachable. The classification provided is “Crypto Scam”, aligning with the targeted brand Kraken, a cryptocurrency exchange, and implying that attackers may seek to harvest login credentials for financial gain.

Uncertainty remains regarding the full malicious payload, any additional command‑and‑control infrastructure, and whether the site ever delivered functional phishing forms before takedown. Defenders should continue to block the domain at perimeter filters, enforce strict outbound DNS controls for the resolved IP, and monitor for any newly registered subdomains under the same registrar that reference Kraken.