app-krakenn-docs[.]framer[.]ai

On 24 July 2026 the domain app-krakenn-docs.framer.ai was observed hosting a page titled “Kraken Login* | Official Account Access”. The title directly references the cryptocurrency exchange Kraken, indicating a brand‑impersonation attempt aimed at harvesting credentials for a crypto‑related service. The domain resolves to the Amazon Web Services address 52.223.52.2, which belongs to ASN 16509 (Amazon.com, Inc.) and is geographically located in the United States. DNS records show four AWS Route 53 name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site employed a Let’s Encrypt certificate (issuer “E8”), and HTTP headers indicated support for HSTS and HTTP/3. Technology fingerprints returned by passive scanning listed Framer Sites and React, consistent with the “framer.ai” hosting platform.

VirusTotal scans recorded 12 detections out of 95 security vendors, confirming that multiple anti‑malware products flag the domain as malicious. Google Safe Browsing classified the URL as a social‑engineering threat. The domain is currently listed on at least one public blocklist and has been taken offline, with PhishDestroy reporting it as blocked. The HTTP response returned a 404 status, suggesting the malicious page has been removed or is no longer served. Registrar information shows the domain was registered on 6 January 2018 through CSC Corporate Domains, Inc., a registrar often used for disposable or rapid‑deployment domains in phishing campaigns.

No further evidence of the page’s content is available because the site is offline, preventing verification of the exact credential‑capture mechanisms. The available data therefore supports a high‑risk assessment for credential‑theft targeting Kraken users, and the classification “Crypto Scam” aligns with the observed brand impersonation.