krakennwebs[.]framer[.]ai

This domain, krakennwebs.framer.ai, is identified as a brand impersonation site targeting Kraken, a cryptocurrency exchange. The page title, 'Kraken Login: Secure Crypto Trading and Portfolio,' directly mimics the legitimate Kraken login portal, indicating an intent to deceive users into submitting credentials. The domain was registered on January 6, 2018, and is currently offline with an HTTP 404 status. Infrastructure analysis reveals it resolves to IP 52.223.52.2, hosted on Amazon Web Services (AS16509) in the US, with nameservers under AWS DNS management. SSL certification is provided by Let's Encrypt, a common choice for both legitimate and malicious sites.

Detection data shows the domain is flagged by 9 of 95 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed. It appears on one security blocklist and is classified as social engineering by Google Safe Browsing. The domain is also blocked by PhishDestroy. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, suggesting a modern web framework was used in its construction. The scam type is explicitly labeled as a crypto scam, aligning with the impersonation of Kraken.

Defenders should treat this domain as a confirmed malicious indicator. While it is currently offline, historical DNS and WHOIS records should be reviewed for any residual connections to active campaigns. The presence of HSTS and HTTP/3 may complicate passive analysis, so active scans or sandboxed visits are not recommended without proper isolation. If this domain reappears, it should be prioritized for takedown due to its clear association with credential theft targeting cryptocurrency users. No evidence of additional payload delivery or secondary infection vectors is present in the available data, but the domain's historical activity warrants monitoring for resurgence.