new-kraken-auth[.]framer[.]ai

Analysis indicates that the domain new-kraken-auth.framer.ai is a confirmed brand impersonation site targeting Kraken, a cryptocurrency exchange. The domain was registered through CSC Corporate Domains, Inc. on January 6, 2018, and currently resolves to the IP address 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States. Infrastructure analysis reveals the use of Framer Sites and React technologies, alongside HSTS and HTTP/3 protocols, which may be leveraged to enhance the site's perceived legitimacy. The page title, 'Kraken.com Login - Buy, Sell and Margin Trade Bitcoin,' explicitly mimics Kraken's official branding, aligning with the reported scam type of a crypto scam. As of July 24, 2026, the domain is offline, returning an HTTP 404 status.

It appears on one security blocklist, and nine out of ninety-five security vendors on VirusTotal flagged the domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites. Nameservers are hosted on AWS (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns), which is consistent with the hosting provider but does not provide additional indicators of compromise. The domain was blocked by PhishDestroy and is classified as a brand impersonation threat with an elevated risk level.

While the current offline status limits further analysis of active malicious behavior, the available evidence—including detection by multiple security vendors, explicit brand targeting, and the use of a page title mirroring Kraken's official login portal—strongly supports its classification as a phishing domain. Defenders are advised to treat this domain as malicious and maintain its inclusion in blocklists. Organizations should monitor for any reactivation attempts and assess whether internal users may have interacted with the site prior to its takedown.