web-kraken-com[.]framer[.]website

Analysis of web-kraken-com.framer.website shows a confirmed brand‑impersonation campaign targeting Kraken users. The domain resolves to the Amazon‑hosted IP address 52.223.52.2, which is registered to AS16509 (Amazon.com, Inc.) and is located in the United States. Registration data indicates the domain was created on 19 November 2021 and is managed by CSC Corporate Domains, Inc., with four AWS name servers (ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, ns-792.awsdns). The site presents a page titled “How to Resolve Common Kraken Login Issues Step by Step”, a typical lure for credential harvesting. The TLS certificate is issued by Let’s Encrypt (E7), and the server advertises HSTS and HTTP/3, consistent with modern web‑hosting stacks. Technology fingerprints identify Framer Sites and React, confirming the use of a publicly available site‑building kit.

From a detection perspective, the domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scans report eight detections out of ninety‑five scanners, indicating that multiple security products have flagged the host as malicious. An HTTP request to the root URL returns a 404 status, suggesting the malicious page may have been removed or is otherwise inaccessible at the time of analysis. The current operational status is recorded as offline. Defenders should treat any traffic to this host as suspicious. Network‑level controls ought to block the IP 52.223.52.2 and the fully qualified domain name.

Email gateways and web proxies should add the domain to deny lists, especially for users of Kraken services. Because the infrastructure resides on Amazon’s cloud platform, legitimate services may share the same ASN; therefore, rule sets should be scoped to the specific domain or IP rather than the entire ASN. Continuous monitoring of the registrar CSC Corporate Domains, Inc.