manage-krakne-eng[.]framer[.]media

manage-krakne-eng.framer.media is a domain created on 19 November 2021 and currently listed as offline. The domain resolves to the IPv4 address 52.223.52.2, which belongs to Amazon Web Services (ASN 16509) and is geolocated in the United States. Registration was performed through CSC Corporate Domains, Inc., and the authoritative name servers are ns-1267.awsdns-30.org, ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, and ns-535.awsdns-. The site presented an HTTPS certificate issued by Let’s Encrypt (certificate identifier E7) and responded with an HTTP 404 status code at the time of observation.

Google Safe Browsing classified the URL as a social‑engineering threat, and the domain appears on one security blocklist. VirusTotal scans show that eight of ninety‑five security vendors flagged the domain as malicious. Automated analysis identified the use of Framer Sites, a React front‑end, HTTP Strict Transport Security, and HTTP/3, consistent with the hosting provider’s default stack. The page title returned by the server reads “Kraken Log‑In | Buy, Sell and Margin Trade Bitcoin”, indicating an attempt to impersonate the cryptocurrency exchange Kraken.

The campaign is categorized as a crypto‑scam and has been blocked by PhishDestroy. The observable evidence confirms that the infrastructure is hosted on a reputable cloud platform, yet the combination of a Let’s Encrypt certificate, a 404 response, and the malicious page title suggests a transient or takedown‑ready phishing page. Defenders should continue to monitor the domain for any re‑activation, enforce blocklist updates, and consider adding the IP address 52.223.52.2 to network‑level deny lists. Because the domain is already offline, incident response actions may focus on correlating any observed traffic or credential submissions with this indicator and updating detection rules to capture similar Framer‑based impersonation attempts targeting Kraken.