platform-kraknee-us[.]framer[.]ai

This domain, platform-kraknee-us.framer.ai, was identified as part of a brand impersonation campaign targeting Kraken, a cryptocurrency exchange. Analysis indicates the domain was taken offline as of the report date, July 25, 2026, though it remains relevant for historical and defensive review. The domain was registered on April 4, 2023, through CSC Corporate Domains, Inc., and resolved to an IP address (35.71.142.77) hosted on Amazon Web Services (AS16509). Nameservers were configured under AWS DNS infrastructure, a common pattern observed in both legitimate and malicious deployments. The page title, 'Sign in to Kraken - Kraken | Buy, Sell and Margin Trade,' explicitly matches Kraken’s official branding, confirming the intent to deceive users into believing the site was legitimate. While the domain is currently returning an HTTP 404 status, this does not preclude prior malicious activity.

Thirteen of 93 security vendors on VirusTotal flagged the domain, suggesting detection by a subset of engines but not widespread consensus. The domain appears on at least one security blocklist and was blocked by PhishDestroy, further corroborating its classification as phishing infrastructure. Technical indicators include the use of Framer Sites and React, technologies often employed for rapid deployment of phishing pages. The domain employed a Let’s Encrypt SSL certificate (serial number E8), which provides encryption but does not validate legitimacy. HSTS and HTTP/3 were also detected, which may have been leveraged to enhance the appearance of authenticity.

The scam type is classified as a crypto scam, aligning with the impersonation of Kraken’s login portal. Defenders should treat this domain as confirmed phishing infrastructure, particularly for retrospective analysis or incident response. While the domain is offline, monitoring for re-registration or similar patterns (e.g., Framer-hosted subdomains mimicking Kraken) is recommended.