tools-kraken-webs[.]framer[.]ai

On 24 July 2026 the domain tools-kraken-webs.framer.ai was observed hosting a site that returned HTTP 404 and presented the page title “Kraken | Buy, Sell and Margin Trade Bitcoin”. The title aligns with the advertised brand Kraken, confirming a brand‑impersonation intent. The domain was registered on 4 April 2023 through CSC Corporate Domains, Inc. and resolves to the Amazon‑owned IP address 35.71.142.77 (AS16509, United States). DNS is served by four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). An SSL certificate issued by Let’s Encrypt (certificate identifier E8) was present, indicating the site used HTTPS with HSTS and HTTP/3 support.

The underlying technology stack was identified as Framer Sites powered by React. Security telemetry shows the domain appears on one external blocklist and has been blocked by PhishDestroy. VirusTotal scans returned eight positive detections out of ninety‑five scanners, reinforcing the malicious classification. The scam type is listed as “Crypto Scam”. Current status is offline, and the site no longer serves content.

The evidence confirms that the domain was used to masquerade as Kraken’s trading platform, likely to lure cryptocurrency users. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no page content was captured. Defenders should add the domain to internal blocklists, monitor the associated IP range for other suspicious activity, and enforce DNS filtering for any subdomains under framer.ai that resolve to the same AWS infrastructure. Ongoing observation of the registrar’s newly created domains is recommended to catch future impersonation attempts.