krakenn-login[.]framer[.]ai

Analysis of krakenn-login.framer.ai indicates a high‑risk brand‑impersonation campaign targeting Kraken users. The domain is currently offline, but historical data shows it was hosted on Amazon Web Services (ASN 16509) in the United States, resolving to IP 52.223.52.2. The site employed a Let's Encrypt E8 certificate, enabling HTTPS with HSTS and HTTP/3, and its front‑end stack included Framer Sites and React. The page title returned by the server was "Secure and Easy Kraken Login Guide | Access Your Account," a clear attempt to lure credential submissions.

Registration was performed through CSC Corporate Domains, Inc., and the authoritative nameservers were AWS‑provided entries (ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns‑15.net, ns‑1198.awsdns‑21.org, among others). Security telemetry shows the domain appeared on one blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classified it as social engineering, and VirusTotal recorded 11 detections out of 93 scanned engines, reinforcing the malicious assessment. HTTP response code 404 suggests the landing page was removed before the final takedown.

While the infrastructure details are concrete, the specific phishing payload and any credential‑harvesting mechanisms remain unverified due to the offline status. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same infrastructure, and advise Kraken users to disregard unsolicited login prompts referencing this URL. Indicators such as the IP address, SSL fingerprint, and the listed AWS nameservers can be incorporated into threat‑intel feeds to improve detection of related replicas.