eng-kraken-sso[.]framer[.]ai

On July 24, 2026 analysts observed that the domain eng-kraken-sso.framer.ai is associated with a brand‑impersonation campaign targeting Kraken users. The page title returned by the server reads "Sign in to Kraken - Kraken.com," directly referencing the legitimate exchange platform and confirming the intent to lure credentials. VirusTotal records show that seven of ninety‑five antivirus and URL‑reputation engines have flagged the domain as malicious, indicating a moderate level of consensus among security vendors. The site is currently blocked by PhishDestroy and appears on a single public blocklist, reinforcing its classification as a threat. Infrastructure analysis reveals that the domain resolves to IP address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States.

The authoritative nameservers—ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns—are typical of AWS‑hosted domains, suggesting the attacker leveraged Amazon’s cloud services for hosting. The TLS certificate is issued by Let’s Encrypt (identifier E8), a free certificate authority commonly used by both legitimate and malicious sites; the presence of HSTS and HTTP/3 indicates modern web protocol support. Technologically the site is built on Framer Sites with a React front‑end, confirming the use of contemporary web development stacks. Registration data shows the domain was created on January 06, 2018 through CSC Corporate Domains, Inc., a registrar that hosts many unrelated legitimate domains, but the age does not preclude malicious reuse.

The domain is presently offline, returning an HTTP 404 status, and has been marked as taken offline in threat intel. The scam type is listed as a crypto scam, aligning with the Kraken brand’s focus on cryptocurrency trading.