stale-encounter-972551[.]framer[.]app

Analysis of stale-encounter-972551.framer.app shows a domain registered through CSC Corporate Domains, Inc. on October 2 2020. The site was hosted on Amazon AWS (AS16509) and resolved to 52.223.52.2, an IP located in the United States. The TLS certificate is issued by Let’s Encrypt (E7) and the server advertised HSTS and HTTP/3, indicating a modern web stack. Detected technologies include Framer Sites and React, consistent with a template‑based deployment. The page title returned by the HTTP endpoint was “Kraken Login | Buy, Sell and Margin Trade Bitcoin”, and the domain is classified as a crypto‑scam that impersonates the Kraken exchange.

VirusTotal recorded 16 of 95 scanners flagging the domain, and it appears on one external security blocklist. PhishDestroy also listed the domain as blocked. The HTTP response code is 404, and the current operational status is offline, suggesting the site has been taken down or is no longer serving content. Defenders should note that the domain’s infrastructure—AWS hosting, Let’s Encrypt certificate, and Framer/React framework—matches patterns observed in other credential‑harvesting campaigns targeting cryptocurrency platforms.

Although the site is presently offline, the domain may be re‑activated or used in future campaigns. Recommendations include adding the domain and its IP address (52.223.52.2) to internal blocklists, monitoring DNS queries for the four authoritative name servers (ns-1371.awsdns-43.org, ns-51.awsdns-06.com, ns-625.awsdns-14.net, ns-2002.awsdns-58), and configuring URL filtering to block any future resolution of the domain. Continuous re‑scanning with multi‑engine services such as VirusTotal is advised to capture any changes in malicious payloads. Organizations that allow Kraken credentials should reinforce MFA and educate users about unsolicited login prompts that reference Kraken, especially those that reference the “Buy, Sell and Margin Trade Bitcoin” phrasing observed here.