kraken-start[.]framer[.]ai

Analysis of kraken-start.framer.ai shows a confirmed cryptocurrency‑related impersonation of the Kraken exchange. The site title "Sign in to Kraken - Kraken | Buy, Sell and Margin Trade Bitcoin" directly references Kraken’s branding, and the domain is listed as impersonating Kraken. Infrastructure data indicate the domain resolves to the Amazon Web Services address 35.71.142.77, hosted under ASN 16509 (Amazon.com, Inc.) in the United States. The domain is served over HTTPS with a Let’s Encrypt certificate (E8), and HTTP requests return a 404 status, suggesting the content may have been removed or is temporarily unavailable. The domain was created on 2018‑01‑06 and is registered through CSC Corporate Domains, Inc., a registrar commonly used for legitimate and malicious actors alike.

Technical fingerprints reveal the use of Framer Sites, React, HSTS, and HTTP/3, all typical of modern web platforms but not indicative of malicious intent on their own. The site appears on a single security blocklist and is blocked by PhishDestroy, confirming that defensive feeds have identified it as malicious. VirusTotal scans show three of ninety‑five security vendors flagged the domain, providing additional independent confirmation of its risk. The current status is offline, which may reduce immediate exposure but does not eliminate the threat; the domain could be re‑activated with a similar payload.

Defenders should update URL filtering rules to block kraken-start.framer.ai, add the associated IP address 35.71.142.77 to deny‑list entries for outbound connections, and monitor DNS logs for any future resolution attempts. Because the registrar and hosting provider are widely used, consider enforcing stricter domain‑age and reputation checks for newly resolved AWS IPs that claim to represent financial services.