appkraakencdn[.]framer[.]ai

The domain appkraakencdn.framer.ai was registered on April 04, 2023 through CSC Corporate Domains, Inc. It resolves to the IPv4 address 35.71.142.77, which belongs to AS16509 Amazon.com, Inc. and is geolocated in the United States. The authoritative name servers are ns-1902.awsdns-45.co.uk, ns-114.awsdns-14.com, ns-635.awsdns-15.net, and ns-1198.awsdns, all of which are part of Amazon’s Route 53 DNS service. An SSL certificate issued by Let’s Encrypt (identifier E8) is present, and the site presents an HTTP 404 response with the page title “Site Not Found | Framer”. Technical fingerprints indicate the use of Framer Sites, React, HSTS, and HTTP/3.

The domain is listed on one security blocklist and is specifically blocked by PhishDestroy. VirusTotal reports that the host was scanned by 95 vendors, none of which flagged it as malicious, though this absence of detections does not constitute a safety assurance. The campaign is classified as a crypto‑scam that impersonates the Kraken brand, targeting users who may be seeking cryptocurrency services.

Current status shows the domain taken offline, but the infrastructure—Amazon‑hosted IP, Let's Encrypt TLS, and Framer‑based hosting—could be reused for future impersonation attempts. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for additional subdomains or similar Framer‑hosted assets that reference Kraken, and consider adding the IP range of AS16509 to threat‑intel watchlists. Continuous re‑evaluation of the blocklist presence and any new vendor scans is recommended to detect re‑activation or replication of the campaign.