sso-krakin-io[.]framer[.]media

This domain, sso-krakin-io.framer.media, was identified as a brand‑impersonation site targeting Kraken users. The page title observed in the live capture, “Log In | Kraken - Buy Bitcoin & Crypto”, directly references the Kraken brand, confirming the impersonation intent. The site was hosted on Amazon’s AS16509 network (IP 52.223.52.2, United States) and operated under a Let's Encrypt certificate issued to the domain, indicating the use of a valid TLS chain despite malicious purpose. Technical fingerprints show the site was built with Framer Sites and React, enabled HSTS, and served over HTTP/3, matching the infrastructure profile of other recent crypto‑related scams.

DNS records list four AWS Route 53 name servers (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-97.awsdns-...). The domain was registered on 19 November 2021 through CSC Corporate Domains, Inc., and has been flagged by ten of ninety‑five VirusTotal scanners, indicating a moderate detection rate among AV engines. It appears on a single public blocklist, specifically PhishDestroy, which has already taken the site offline, resulting in an HTTP 404 response at the time of analysis. While the site is currently inaccessible, the combination of brand‑specific page title, crypto‑scam classification, and observed infrastructure suggests a deliberate attempt to harvest Kraken credentials.

The presence of a legitimate TLS certificate does not mitigate the threat, as attackers frequently obtain free certificates to increase user trust. Defenders should add the domain and its associated IP address to outbound and inbound filtering rules, monitor for new subdomains under the framer.media hoster that employ similar technology stacks, and verify that any internal Kraken‑related authentication flows enforce strict certificate pinning and multi‑factor authentication.