kraakenn-login[.]framer[.]media

Analysis indicates that the domain kraakenn-login.framer.media, registered on February 21 2026 through CSC Corporate Domains, Inc., was used to host a fraudulent login page purporting to be a Kraken portal, as evidenced by the page title “Kraken Login | Access Your Crypto Account Quickly & Safely”. The site employed modern web technologies including Framer Sites, React, HTTP/3, and enforced HSTS, and was served over a valid Let’s Encrypt certificate (E7). DNS resolution pointed to the IP address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain is currently taken offline and returns an HTTP 404 status, but historical scans show that 10 of 93 VirusTotal scanners flagged the host, and Google Safe Browsing classified it as a social engineering threat.

The domain appears on a single security blocklist and was specifically blocked by PhishDestroy. Nameserver configuration includes ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, among others. The combination of brand‑specific page title, the Kraken impersonation tag, and the observed security vendor detections confirm the infrastructure’s purpose as a crypto‑related credential‑stealing operation. At present, no active content is reachable, limiting immediate victim acquisition, yet the hosting pattern suggests the operator may reuse the same AWS infrastructure for future campaigns.

Defenders should continue to monitor the IP 35.71.142.77 and associated AWS name servers for re‑activation, enforce blocklist entries for the domain, and consider adding the IP to network‑level deny lists. Organizations that use Kraken services should educate users about unsolicited login prompts and verify the authenticity of URLs before credential submission. Ongoing threat‑intel feeds should be consulted for any resurgence of the domain or related sub‑domains.