VirusTotal
6 / 95
“Sign in to Kraken - Kraken | Buy, Sell and Margin Trade Bitcoin”
This domain, portal-krqakn.framer.website, operates as a fraudulent login portal impersonating Kraken, a well-known cryptocurrency exchange. The site is designed to harvest user credentials by presenting a near-identical copy of Kraken’s sign-in interface, tricking visitors into entering sensitive account details. Such brand impersonation schemes often lead to unauthorized account access, financial theft, or further exploitation through phishing campaigns. The page title, 'Sign in to Kraken - Kraken | Buy, Sell and Margin Trade Bitcoin,' reinforces the deception by mimicking legitimate Kraken branding and functionality descriptions. Analysis indicates this domain was created on November 19, 2021, and is registered through CSC Corporate Domains, Inc. Infrastructure review reveals it resolves to the IP address 52.223.52.2 and employs a Let’s Encrypt SSL certificate, which, while encrypting traffic, does not validate the site’s legitimacy. Security vendors on VirusTotal have flagged this domain as malicious, with 6 out of 95 engines detecting it as a threat. Additionally, Google Safe Browsing categorizes the site under 'SOCIAL_ENGINEERING,' and it appears on one security blocklist, further confirming its fraudulent nature. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which are commonly used in both legitimate and malicious web applications. If you visited portal-krqakn.framer.website or entered any credentials, immediate action is required. First, cease all interaction with the site and do not provide any additional information. Change the passwords for your Kraken account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to add an extra layer of security. Monitor your accounts for unauthorized transactions or suspicious activity, and report any anomalies to the legitimate service provider. Consider running a security scan on your device to check for malware or other threats that may have been introduced during the visit.
Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.
Framer/af6a429Scanner note: hosting_placeholder: raw=placeholder; http=404; via=https_proxy; server=Framer/af6a429
ns-1243.awsdns-27.orgns-1818.awsdns-35.co.ukns-336.awsdns-42.comns-792.awsdns-35.netLocation describes the IP network.
b3445573cc07ede57a843d22babf8e3b977a95a08dd21a6706de7226e732d6ceSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Google PageSpeed Insights — mobile performance audit of portal-krqakn.framer.website · checked Jun 27, 2026
15 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
114 stored lookalike domains
Showing 100 of 114
Reported by 1 community member, first seen Nov 29, 2025
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Select your country to get official cybercrime contacts, or create a complaint draft →.
Template-based draft · optional AI wording assistance requires separate consent
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowSubmit suspicious domains to our threat database — protect the community
ReportRecent phishing reports and observed availability changes
MonitorMonitor live threats or contest this listing if you believe it's a false positive